theory Syscall_C

lemma handleInvocation_ccorres:
  "ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and
        ct_active' and sch_act_simple and
        (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x)))
       (UNIV \<inter> {s. isCall_' s = from_bool isCall}
             \<inter> {s. isBlocking_' s = from_bool isBlocking}) []
       (handleInvocation isCall isBlocking) (Call handleInvocation_'proc)" apply (cinit' lift: isCall_' isBlocking_'
                simp: whileAnno_def handleInvocation_def2) apply (simp add: liftE_bindE del: Collect_const cong: call_ignore_cong) apply (ctac(no_vcg) add: getCurThread_ccorres) apply (ctac(no_vcg) add: getMessageInfo_ccorres) apply (simp del: Collect_const cong: call_ignore_cong) apply csymbr apply (ctac(no_vcg) add: getRegister_ccorres) apply (simp add: Syscall_H.syscall_def
                        liftE_bindE split_def bindE_bind_linearise
                  cong: call_ignore_cong
                   del: Collect_const) apply (rule_tac ccorres_split_nothrow_case_sum) apply (ctac add: capFaultOnFailure_ccorres
                                 [OF lookupCapAndSlot_ccorres]) apply ceqv apply (simp add: ccorres_cond_iffs Collect_False
                     cong: call_ignore_cong
                      del: Collect_const) apply (simp only: bind_assoc) apply (ctac(no_vcg) add: lookupIPCBuffer_ccorres) apply (simp add: liftME_def bindE_assoc del: Collect_const) apply (simp add: bindE_bind_linearise del: Collect_const) apply (rule_tac xf'="\<lambda>s. (status_' s,
                                current_extra_caps_' (globals s))"
                             and ef'=fst and vf'=snd and es=errstate
                        in ccorres_split_nothrow_novcg_case_sum) apply (rule ccorres_call, rule lookupExtraCaps_ccorres, simp+) apply (rule ceqv_tuple2, ceqv, ceqv) apply (simp add: returnOk_bind liftE_bindE
                                Collect_False
                                ccorres_cond_iffs ts_Restart_case_helper'
                           del: Collect_const cong: bind_cong) apply (rule ccorres_rhs_assoc2,
                      rule ccorres_rhs_assoc2,
                      rule_tac xf'="length___unsigned_long_'"
                            and r'="\<lambda>rv rv'. unat rv' = length rv"
                            in ccorres_split_nothrow) apply (rule ccorres_add_return2) apply (rule ccorres_symb_exec_l) apply (rule_tac P="\<lambda>s. rvd \<noteq> Some 0 \<and> (if rvd = None then
                                               length x = min (unat (n_msgRegisters))
                                                            (unat (msgLength (messageInfoFromWord ret__unsigned_long)))
                                             else
                                               length x = (unat (msgLength (messageInfoFromWord ret__unsigned_long))))"
                                  and P'=UNIV
                                   in ccorres_from_vcg) apply (clarsimp simp: return_def) apply (rule conseqPre, vcg) apply (clarsimp simp: word_less_nat_alt) apply (rule conjI) apply clarsimp apply (case_tac rvd, clarsimp simp: option_to_ptr_def option_to_0_def min_def n_msgRegisters_def) apply (clarsimp simp: option_to_0_def option_to_ptr_def) apply clarsimp apply (case_tac rvd,
                             clarsimp simp: option_to_0_def min_def option_to_ptr_def
                                            n_msgRegisters_def
                                     split: if_splits) apply (clarsimp simp: option_to_0_def option_to_ptr_def) apply wp apply (wp getMRs_length) apply simp apply ceqv apply csymbr apply (simp only: bind_assoc[symmetric]) apply (rule ccorres_split_nothrow_novcg_case_sum) apply (ctac add: decodeInvocation_ccorres) apply ceqv apply (simp add: Collect_False exception_defs
                                      replyOnRestart_def liftE_def bind_assoc
                                 del: Collect_const) apply (rule ccorres_move_c_guard_tcb) apply (rule getThreadState_ccorres_foo) apply csymbr apply (rule ccorres_abstract_cleanup) apply (rule_tac P="ret__unsigned = thread_state_to_tsType rvg"
                                 in ccorres_gen_asm2) apply (simp add: thread_state_to_tsType_eq_Restart from_bool_0
                                 del: Collect_const add: Collect_const[symmetric]) apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_Cond_rhs_Seq) apply (simp add: bind_assoc) apply (ctac(no_vcg) add: replyFromKernel_success_empty_ccorres) apply (ctac(no_vcg) add: setThreadState_ccorres) apply (rule ccorres_return_CE[folded return_returnOk], simp+)[1] apply wp+ apply (rule hoare_strengthen_post, rule rfk_invs') apply auto[1] apply simp apply (ctac(no_vcg) add: setThreadState_ccorres) apply (rule ccorres_return_CE[folded return_returnOk], simp+)[1] apply wp apply simp apply (rule ccorres_return_CE[folded return_returnOk], simp+)[1] apply wpc apply (simp add: syscall_error_rel_def from_bool_0 exception_defs
                                      Collect_False ccorres_cond_iffs Collect_True
                                 del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply (simp add: liftE_def Collect_const[symmetric]
                                 del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply simp apply (ctac(no_vcg) add: replyFromKernel_error_ccorres) apply (rule ccorres_split_throws) apply (rule ccorres_return_CE[folded return_returnOk], simp+)[1] apply vcg apply wp apply simp apply (rule ccorres_split_throws) apply (rule ccorres_return_CE[folded return_returnOk], simp+)[1] apply vcg apply (simp add: cintr_def) apply (rule ccorres_split_throws) apply (rule ccorres_return_C_errorE, simp+)[1] apply vcg apply (simp add: invocationCatch_def o_def) apply (rule_tac Q="\<lambda>rv'. invs' and tcb_at' rv"
                               and E="\<lambda>ft. invs' and tcb_at' rv"
                              in hoare_post_impErr) apply (wp hoare_split_bind_case_sumE hoare_drop_imps
                               setThreadState_nonqueued_state_update
                               ct_in_state'_set setThreadState_st_tcb
                               hoare_vcg_all_lift sts_ksQ'
                                 | wpc | wps)+ apply auto[1] apply clarsimp apply (clarsimp simp: guard_is_UNIV_def Collect_const_mem) apply (simp add: "StrictC'_thread_state_defs" mask_def) apply (simp add: typ_heap_simps) apply (case_tac ts, simp_all add: cthread_state_relation_def)[1] apply (clarsimp simp: guard_is_UNIV_def Collect_const_mem) apply (clarsimp simp add: intr_and_se_rel_def exception_defs
                                           syscall_error_rel_def cintr_def
                                    split: sum.split_asm) apply (simp add: conj_comms) apply (wp getMRs_sysargs_rel) apply (simp add: ) apply vcg apply (simp add: ccorres_cond_iffs ccorres_seq_cond_raise
                               Collect_True Collect_False
                          del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply (simp add: ccorres_cond_iffs Collect_const[symmetric]
                          del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: from_bool_0 liftE_def) apply (ctac(no_vcg) add: handleFault_ccorres) apply (rule ccorres_split_throws) apply (rule ccorres_return_CE[folded return_returnOk], simp+)[1] apply vcg apply wp apply (simp add: from_bool_0 liftE_def) apply (rule ccorres_split_throws) apply (rule ccorres_return_CE[folded return_returnOk], simp+)[1] apply vcg apply (simp add: ball_conj_distrib) apply (wp lookupExtraCaps_excaps_in_mem
                       lec_dimished'[unfolded o_def]
                       lec_derived'[unfolded o_def]) apply (clarsimp simp: guard_is_UNIV_def option_to_ptr_def
                                  mi_from_H_def) apply (clarsimp simp: guard_is_UNIV_def) apply simp apply (wp lookupIPCBuffer_Some_0) apply (simp add: Collect_True liftE_def return_returnOk
                     del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply (rule_tac P=\<top> in ccorres_cross_over_guard) apply (rule ccorres_symb_exec_r) apply (rule ccorres_split_nothrow_novcg_dc) apply (rule ccorres_when[where R=\<top>]) apply (simp add: from_bool_0 Collect_const_mem) apply (ctac add: handleFault_ccorres) apply (rule ccorres_split_throws) apply (rule ccorres_return_CE, simp+)[1] apply vcg apply wp apply (simp add: guard_is_UNIV_def) apply vcg apply (rule conseqPre, vcg) apply clarsimp apply (simp, wp lcs_eq[unfolded o_def]) apply clarsimp apply (vcg exspec= lookupCapAndSlot_modifies) apply simp apply (wp getMessageInfo_le3 getMessageInfo_msgLength')+ apply (simp add: msgMaxLength_def, wp getMessageInfo_msgLength')[1] apply simp apply wp apply (clarsimp simp: Collect_const_mem) apply (simp add: Kernel_C.msgInfoRegister_def ARM_H.msgInfoRegister_def
                    ARM.msgInfoRegister_def Kernel_C.R1_def
                    Kernel_C.capRegister_def ARM_H.capRegister_def
                    ARM.capRegister_def Kernel_C.R0_def) apply (clarsimp simp: cfault_rel_def option_to_ptr_def) apply (simp add: seL4_Fault_CapFault_lift is_cap_fault_def) apply (frule lookup_failure_rel_fault_lift, assumption) apply clarsimp apply (clarsimp simp: ct_in_state'_def pred_tcb_at') apply (auto simp: ct_in_state'_def sch_act_simple_def intro!: active_ex_cap'
              elim!: pred_tcb'_weakenE dest!: st_tcb_at_idle_thread')[1] done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) (UNIV \<inter> \<lbrace>\<acute>isCall = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool isBlocking\<rbrace>) [] (handleInvocation isCall isBlocking) (Call handleInvocation_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2563 isBlockinga isCalla) (?Q'2563 isBlockinga isCalla) [SKIP] (do thread <- getCurThread;
info <- getMessageInfo thread;
ptr <- asUser thread (getRegister Thread_H.capRegister);
v <- doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
buffer <- liftE (lookupIPCBuffer False thread);
extracaps <- lookupExtraCaps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE;
case v of Inl f \<Rightarrow> liftE (when isBlocking (handleFault thread f)) | Inr (slot, cap, extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer info;
v' <- global.decodeInvocation (msgLabel info) args ptr slot cap extracaps >>= invocationCatch thread isBlocking isCall id;
case v' of Inl (Inl syserr) \<Rightarrow> liftE (when isCall (replyFromKernel thread (msgFromSyscallError syserr))) | Inl (Inr preempt) \<Rightarrow> throwError preempt | Inr x \<Rightarrow> liftE (replyOnRestart thread [] isCall)
od
od) (\<acute>thread :== \<acute>ksCurThread;;
(\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
(\<acute>info :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long);;
(\<acute>cptr :== CALL getRegister_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister);;
(\<acute>lu_ret :== CALL lookupCapAndSlot_'proc(\<acute>thread,\<acute>cptr);;
(IF lookupCapAndSlot_ret_C.status_C \<acute>lu_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlockinga \<noteq> 0 THEN
  CALL handleFault_'proc(\<acute>thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(\<acute>thread,\<acute>buffer,\<acute>info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlockinga \<noteq> 0 THEN
  CALL handleFault_'proc(\<acute>thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(\<acute>info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,\<acute>cptr,lookupCapAndSlot_ret_C.slot_C \<acute>lu_ret,lookupCapAndSlot_ret_C.cap_C \<acute>lu_ret,isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCalla \<noteq> 0 THEN
  CALL replyFromKernel_error_'proc(\<acute>thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCalla \<noteq> 0 THEN
  CALL replyFromKernel_success_empty_'proc(\<acute>thread)
FI;;
CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))))))))
 2. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2563 isBlockinga isCalla s \<and> s' \<in> ?Q'2563 isBlockinga isCalla proof (prove)
goal (2 subgoals):
 1. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2563 (from_bool isBlocking) (from_bool isCall)) (?Q'2563 (from_bool isBlocking) (from_bool isCall)) [SKIP] (do thread <- getCurThread;
info <- getMessageInfo thread;
ptr <- asUser thread (getRegister Thread_H.capRegister);
v <- doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE;
case v of Inl f \<Rightarrow> liftE (when isBlocking (handleFault thread f)) | Inr (slot, cap, extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer info;
v' <- global.decodeInvocation (msgLabel info) args ptr slot cap extracaps >>= invocationCatch thread isBlocking isCall id;
case v' of Inl (Inl syserr) \<Rightarrow> liftE (when isCall (replyFromKernel thread (msgFromSyscallError syserr))) | Inl (Inr preempt) \<Rightarrow> throwError preempt | Inr x \<Rightarrow> liftE (replyOnRestart thread [] isCall)
od
od) (\<acute>thread :== \<acute>ksCurThread;;
(\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
(\<acute>info :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long);;
(\<acute>cptr :== CALL getRegister_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister);;
(\<acute>lu_ret :== CALL lookupCapAndSlot_'proc(\<acute>thread,\<acute>cptr);;
(IF lookupCapAndSlot_ret_C.status_C \<acute>lu_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(\<acute>thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(\<acute>thread,\<acute>buffer,\<acute>info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(\<acute>thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(\<acute>info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,\<acute>cptr,lookupCapAndSlot_ret_C.slot_C \<acute>lu_ret,lookupCapAndSlot_ret_C.cap_C \<acute>lu_ret,isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(\<acute>thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(\<acute>thread)
FI;;
CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))))))))
 2. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2563 isBlockinga isCalla s \<and> s' \<in> ?Q'2563 isBlockinga isCalla proof (prove)
goal (4 subgoals):
 1. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2574 isBlockinga isCalla rv) (?Q'2574 isBlockinga isCalla rv thread) [SKIP] (do info <- getMessageInfo rv;
ptr <- asUser rv (getRegister Thread_H.capRegister);
v <- doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot rv ptr);
do buffer <- lookupIPCBuffer False rv;
doE extracaps <- lookupExtraCaps rv buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE;
case v of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr (slot, cap, extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer info;
v' <- global.decodeInvocation (msgLabel info) args ptr slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case v' of Inl (Inl syserr) \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inl (Inr preempt) \<Rightarrow> throwError preempt | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od
od) (\<acute>ret__unsigned_long :== CALL getRegister_'proc(thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
(\<acute>info :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long);;
(\<acute>cptr :== CALL getRegister_'proc(thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister);;
(\<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,\<acute>cptr);;
(IF lookupCapAndSlot_ret_C.status_C \<acute>lu_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,\<acute>info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(\<acute>info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,\<acute>cptr,lookupCapAndSlot_ret_C.slot_C \<acute>lu_ret,lookupCapAndSlot_ret_C.cap_C \<acute>lu_ret,isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))))))
 2. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>?Q2574 isBlockinga isCalla\<rbrace>
 3. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'2574 isBlockinga isCalla rv (thread_' s)
 4. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread; rva = messageInfoFromWord ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3311 isBlockinga isCalla rv thread rva) (?Q'3311 isBlockinga isCalla rv thread rva ret__unsigned_long) [SKIP] (do ptr <- asUser rv (getRegister Thread_H.capRegister);
v <- doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot rv ptr);
do buffer <- lookupIPCBuffer False rv;
doE extracaps <- lookupExtraCaps rv buffer rva;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE;
case v of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr (slot, cap, extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
v' <- global.decodeInvocation (msgLabel rva) args ptr slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case v' of Inl (Inl syserr) \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inl (Inr preempt) \<Rightarrow> throwError preempt | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od
od) (\<acute>info :== CALL messageInfoFromWord_'proc(ret__unsigned_long);;
(\<acute>cptr :== CALL getRegister_'proc(thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister);;
(\<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,\<acute>cptr);;
(IF lookupCapAndSlot_ret_C.status_C \<acute>lu_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,\<acute>info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(\<acute>info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,\<acute>cptr,lookupCapAndSlot_ret_C.slot_C \<acute>lu_ret,lookupCapAndSlot_ret_C.cap_C \<acute>lu_ret,isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))))))
 2. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>?Q3311 isBlockinga isCalla rv thread\<rbrace>
 3. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 4. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'3311 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t)}
 5. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3311 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)) (?Q'3311 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long) [SKIP] (do ptr <- asUser rv (getRegister Thread_H.capRegister);
v <- doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot rv ptr);
do buffer <- lookupIPCBuffer False rv;
doE extracaps <- lookupExtraCaps rv buffer (messageInfoFromWord ret__unsigned_long);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE;
case v of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr (slot, cap, extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
v' <- global.decodeInvocation (msgLabel rva) args ptr slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case v' of Inl (Inl syserr) \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inl (Inr preempt) \<Rightarrow> throwError preempt | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od
od) (\<acute>info :== CALL messageInfoFromWord_'proc(ret__unsigned_long);;
(\<acute>cptr :== CALL getRegister_'proc(thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister);;
(\<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,\<acute>cptr);;
(IF lookupCapAndSlot_ret_C.status_C \<acute>lu_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,\<acute>info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(\<acute>info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,\<acute>cptr,lookupCapAndSlot_ret_C.slot_C \<acute>lu_ret,lookupCapAndSlot_ret_C.cap_C \<acute>lu_ret,isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))))))
 2. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>?Q3311 isBlockinga isCalla rv thread\<rbrace>
 3. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 4. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'3311 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t)}
 5. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3311 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)) (?G'4014 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info) [SKIP] (do ptr <- asUser rv (getRegister Thread_H.capRegister);
v <- doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot rv ptr);
do buffer <- lookupIPCBuffer False rv;
doE extracaps <- lookupExtraCaps rv buffer (messageInfoFromWord ret__unsigned_long);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE;
case v of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr (slot, cap, extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
v' <- global.decodeInvocation (msgLabel rva) args ptr slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case v' of Inl (Inl syserr) \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inl (Inr preempt) \<Rightarrow> throwError preempt | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od
od) (\<acute>cptr :== CALL getRegister_'proc(thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister);;
(\<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,\<acute>cptr);;
(IF lookupCapAndSlot_ret_C.status_C \<acute>lu_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,\<acute>cptr,lookupCapAndSlot_ret_C.slot_C \<acute>lu_ret,lookupCapAndSlot_ret_C.cap_C \<acute>lu_ret,isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))))
 2. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>?Q3311 isBlockinga isCalla rv thread\<rbrace>
 3. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 4. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> ?G'4014 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v}}
 5. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4696 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb) (?Q'4711 rv thread ret__unsigned_long info rvb cptr) [SKIP] (do v <- doE (cap, slot) <- capFaultOnFailure rvb False (lookupCapAndSlot rv rvb);
do buffer <- lookupIPCBuffer False rv;
doE extracaps <- lookupExtraCaps rv buffer (messageInfoFromWord ret__unsigned_long);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE;
case v of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr (slot, cap, extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
v' <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case v' of Inl (Inl syserr) \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inl (Inr preempt) \<Rightarrow> throwError preempt | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od
od) (\<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr);;
(IF lookupCapAndSlot_ret_C.status_C \<acute>lu_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C \<acute>lu_ret,lookupCapAndSlot_ret_C.cap_C \<acute>lu_ret,isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>?Q4696 isBlockinga isCalla rv thread rva ret__unsigned_long info\<rbrace>
 3. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 4. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 5. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> ?Q'4710 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 6. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info t rva. ?Q'4711 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long. ?Q'4710 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long proof (prove)
goal (6 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4696 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr) (?Q'4711 rv thread ret__unsigned_long info cptr cptr) [SKIP] (capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) >>= case_sum (case_sum (\<lambda>f. liftE (when isBlocking (handleFault rv f))) (\<lambda>(slot, cap, extracaps, buffer). do args <- getMRs rv buffer rva;
global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id >>= case_sum (case_sum (\<lambda>syserr. liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr)))) throwError) (\<lambda>x. liftE (replyOnRestart rv [] isCall))
od) \<circ> Inl) (\<lambda>rvc. do buffer <- lookupIPCBuffer False rv;
doE extracaps <- lookupExtraCaps rv buffer (messageInfoFromWord ret__unsigned_long);
returnOk (snd rvc, fst rvc, extracaps, buffer)
odE
od >>= case_sum (\<lambda>f. liftE (when isBlocking (handleFault rv f))) (\<lambda>(slot, cap, extracaps, buffer). do args <- getMRs rv buffer rva;
global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id >>= case_sum (case_sum (\<lambda>syserr. liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr)))) throwError) (\<lambda>x. liftE (replyOnRestart rv [] isCall))
od))) (\<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr);;
(IF lookupCapAndSlot_ret_C.status_C \<acute>lu_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C \<acute>lu_ret,lookupCapAndSlot_ret_C.cap_C \<acute>lu_ret,isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>?Q4696 isBlockinga isCalla rv thread rva ret__unsigned_long info\<rbrace>
 3. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 4. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 5. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> ?Q'4710 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 6. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info t rva. ?Q'4711 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long. ?Q'4710 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> ccorres (?f'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr \<currency> ?r'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr) (liftxf (?es5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr) (?ef'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr) (?vf'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr) (?xf'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr)) (?P5553 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr) (?P'5544 rv thread ret__unsigned_long info cptr cptr) [SKIP] (capFaultOnFailure cptr False (lookupCapAndSlot rv cptr)) (\<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv' t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr) rv' t t' (IF lookupCapAndSlot_ret_C.status_C \<acute>lu_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C \<acute>lu_ret,lookupCapAndSlot_ret_C.cap_C \<acute>lu_ret,isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))) (?d'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv')
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; ?r'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc (?vf'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv'); ?ef'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc) (?Q'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv') [SKIP] (do a <- do buffer <- lookupIPCBuffer False rv;
doE extracaps <- lookupExtraCaps rv buffer (messageInfoFromWord ret__unsigned_long);
returnOk (snd rvc, fst rvc, extracaps, buffer)
odE
od;
case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od
od) (?d'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv')
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; ?ef'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err (?ef'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (?d'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv')
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>?Q5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. ?ef'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr (?xf'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ?r'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv' (?vf'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr (?xf'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr s)) \<longrightarrow> s \<in> ?Q'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv' (?xf'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr s)) \<and> (\<forall>ft. ?ef'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr (?xf'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ?f'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (?ef'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr (?xf'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr s)) (?es5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr s) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (?xf'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr s) (?es5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr s))}
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. ?P5553 isBlockinga isCalla rv thread rva ret__unsigned_long info a and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 9. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 10. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> ?P'5548 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?P'5548 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?P'5544 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t)
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv' t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> lu_ret_' rv' t t' (IF lookupCapAndSlot_ret_C.status_C \<acute>lu_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C \<acute>lu_ret,lookupCapAndSlot_ret_C.cap_C \<acute>lu_ret,isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))) (?d'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv')
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc) (?Q'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv') [SKIP] (do a <- do buffer <- lookupIPCBuffer False rv;
doE extracaps <- lookupExtraCaps rv buffer (messageInfoFromWord ret__unsigned_long);
returnOk (snd rvc, fst rvc, extracaps, buffer)
odE
od;
case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od
od) (?d'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv')
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (?d'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv')
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>?Q5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> ?Q'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv' (lu_ret_' s)) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 8. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 9. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 10. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc) (?Q'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv') [SKIP] (do a <- do buffer <- lookupIPCBuffer False rv;
doE extracaps <- lookupExtraCaps rv buffer (messageInfoFromWord ret__unsigned_long);
returnOk (snd rvc, fst rvc, extracaps, buffer)
odE
od;
case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od
od) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>?Q5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> ?Q'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv' (lu_ret_' s)) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 7. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 8. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 9. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5542 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc) (?Q'5542 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv') [SKIP] (do buffer <- lookupIPCBuffer False rv;
doE extracaps <- lookupExtraCaps rv buffer (messageInfoFromWord ret__unsigned_long);
returnOk (snd rvc, fst rvc, extracaps, buffer)
odE
od >>= case_sum (\<lambda>f. liftE (when isBlocking (handleFault rv f))) (\<lambda>(slot, cap, extracaps, buffer). do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps >>= invocationCatch rv isBlocking isCall id >>= case_sum (case_sum (\<lambda>syserr. liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr)))) throwError) (\<lambda>x. liftE (replyOnRestart rv [] isCall))
od)) (\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>?Q5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> ?Q'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv' (lu_ret_' s)) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 7. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 8. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 9. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5542 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc) (?Q'5542 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv') [SKIP] (do buffer <- lookupIPCBuffer False rv;
y <- doE extracaps <- lookupExtraCaps rv buffer (messageInfoFromWord ret__unsigned_long);
returnOk (snd rvc, fst rvc, extracaps, buffer)
odE;
case y of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr (slot, cap, extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
invocationCatch rv isBlocking isCall id x >>= case_sum (case_sum (\<lambda>syserr. liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr)))) throwError) (\<lambda>x. liftE (replyOnRestart rv [] isCall))
od
od) (\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>?Q5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> ?Q'5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv' (lu_ret_' s)) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 7. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 8. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 9. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ((=) \<circ> option_to_ptr) rvd buffer\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6356 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd) (?Q'6370 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer) [SKIP] (do y <- doE extracaps <- lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long);
returnOk (snd rvc, fst rvc, extracaps, rvd)
odE;
case y of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr (slot, cap, extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
invocationCatch rv isBlocking isCall id x >>= case_sum (case_sum (\<lambda>syserr. liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr)))) throwError) (\<lambda>x. liftE (replyOnRestart rv [] isCall))
od
od) (\<acute>status :== CALL lookupExtraCaps_'proc(thread,buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>?Q6356 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvc. ((=) \<circ> option_to_ptr) rvc (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'6369 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv' (lu_ret_' s) t rvc}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 8. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 9. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 10. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' t rva. ?Q'6370 rv thread ret__unsigned_long info cptr rvc rv' rva (ret__ptr_to_unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr. ?Q'6369 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6356 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd) (?Q'6370 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer) [SKIP] (do y <- doE extracaps <- lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long);
returnOk (snd rvc, fst rvc, extracaps, rvd)
odE;
case y of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr (slot, cap, extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
invocationCatch rv isBlocking isCall id x >>= case_sum (case_sum (\<lambda>syserr. liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr)))) throwError) (\<lambda>x. liftE (replyOnRestart rv [] isCall))
od
od) (\<acute>status :== CALL lookupExtraCaps_'proc(thread,buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>?Q6356 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvc. ((=) \<circ> option_to_ptr) rvc (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'6369 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv' (lu_ret_' s) t rvc}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 8. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 9. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 10. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' t rva. ?Q'6370 rv thread ret__unsigned_long info cptr rvc rv' rva (ret__ptr_to_unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr. ?Q'6369 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6356 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd) (?Q'6370 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer) [SKIP] (lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) >>= case_sum (case_sum (\<lambda>f. liftE (when isBlocking (handleFault rv f))) (\<lambda>(slot, cap, extracaps, buffer). do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
invocationCatch rv isBlocking isCall id x >>= case_sum (case_sum (\<lambda>syserr. liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr)))) throwError) (\<lambda>x. liftE (replyOnRestart rv [] isCall))
od) \<circ> Inl) (\<lambda>rva. returnOk (snd rvc, fst rvc, rva, rvd) >>= case_sum (\<lambda>f. liftE (when isBlocking (handleFault rv f))) (\<lambda>(slot, cap, extracaps, buffer). do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
invocationCatch rv isBlocking isCall id x >>= case_sum (case_sum (\<lambda>syserr. liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr)))) throwError) (\<lambda>x. liftE (replyOnRestart rv [] isCall))
od))) (\<acute>status :== CALL lookupExtraCaps_'proc(thread,buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>?Q6356 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvc. ((=) \<circ> option_to_ptr) rvc (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'6369 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rv' (lu_ret_' s) t rvc}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 8. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 9. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 10. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' t rva. ?Q'6370 rv thread ret__unsigned_long info cptr rvc rv' rva (ret__ptr_to_unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr. ?Q'6369 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> ccorres (?f'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer \<currency> ?r'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer) (liftxf errstate fst snd (\<lambda>s. (status_' s, current_extra_caps_' (globals s)))) (?P7011 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd) (?Q'6370 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer) [] (lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long)) (\<acute>status :== CALL lookupExtraCaps_'proc(thread,buffer,info))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rv'a t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) rv'a t t' (IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))) (?d'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rv'a)
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; ?r'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve (snd rv'a); fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve) (?Q'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a) [SKIP] (do a <- returnOk (snd rvc, fst rvc, rve, rvd);
case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od
od) (?d'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rv'a)
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err (fst rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (?d'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rv'a)
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rve rv'a. ?r'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve (snd rv'a)) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rve. ?f'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err (fst rve)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. ?P7011 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' t rva. ?Q'6370 rv thread ret__unsigned_long info cptr rvc rv' rva (ret__ptr_to_unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr. ?Q'6369 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rv'a t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) rv'a t t' (IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))) (?d'7005 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rv'a)
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve) (?Q'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a) [SKIP] (do a <- returnOk (snd rvc, fst rvc, rve, rvd);
case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od
od) (?d'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rv'a)
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (?d'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rv'a)
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve) (?Q'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a) [SKIP] (do a <- returnOk (snd rvc, fst rvc, rve, rvd);
case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od
od) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7005 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve) (?Q'7005 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) [SKIP] (do v <- getMRs rv rvd (messageInfoFromWord ret__unsigned_long);
v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) v cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl (Inl syserr) \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inl (Inr xa) \<Rightarrow> throwError xa | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (18 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. unat rv' = length rv) length___unsigned_long_' (?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve) (?P'7559 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) [SKIP] (getMRs rv rvd (messageInfoFromWord ret__unsigned_long)) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI)
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. ?P7566 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?P'7559 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (18 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. unat rv' = length rv) length___unsigned_long_' (?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve) (?P'7559 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) [SKIP] (getMRs rv rvd (messageInfoFromWord ret__unsigned_long) >>= return) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI)
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. ?P7566 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?P'7559 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a x. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. unat rv' = length rv) length___unsigned_long_' (?Q7578 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a x) (?Q'7576 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a x) [SKIP] (return x) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI)
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7578 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. ?P7566 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a x. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (rvd \<noteq> Some 0 \<and> (if rvd = None then length x = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length x = unat (msgLength (messageInfoFromWord ret__unsigned_long)))) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<exists>(rv, \<sigma>')\<in>fst (return x \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> unat (length___unsigned_long_' s) = length rv}
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. rvd \<noteq> Some 0 \<and> (if rvd = None then length a = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length a = unat (msgLength (messageInfoFromWord ret__unsigned_long)))\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. ?P7566 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>ret__unsigned_long info a b rv' rvd rve ba x \<sigma>. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. rvd \<noteq> Some 0 \<and> (if rvd = None then length x = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length x = unat (msgLength (messageInfoFromWord ret__unsigned_long))) \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> option_to_ptr rvd = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. (\<sigma>, s) \<in> rf_sr \<and> unat (length___unsigned_long_' s) = length x}
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. rvd \<noteq> Some 0 \<and> (if rvd = None then length a = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length a = unat (msgLength (messageInfoFromWord ret__unsigned_long)))\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. ?P7566 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>ret__unsigned_long info a b rv' rvd rve ba x \<sigma>. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b\<rbrakk> \<Longrightarrow> {s. rvd \<noteq> Some 0 \<and> (if rvd = None then length x = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length x = unat (msgLength (messageInfoFromWord ret__unsigned_long))) \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. ret__unsigned_' t = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> option_to_ptr rvd = NULL \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_' := length_CL (seL4_MessageInfo_lift info), length___unsigned_long_' := SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rparr>) \<in> rf_sr \<and> unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length x) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> option_to_ptr rvd = NULL) \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_' := length_CL (seL4_MessageInfo_lift info), length___unsigned_long_' := length_CL (seL4_MessageInfo_lift info)\<rparr>) \<in> rf_sr \<and> unat (length_CL (seL4_MessageInfo_lift info)) = length x)}
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. rvd \<noteq> Some 0 \<and> (if rvd = None then length a = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length a = unat (msgLength (messageInfoFromWord ret__unsigned_long)))\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. ?P7566 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>ret__unsigned_long info a b rv' rvd rve ba x \<sigma> xa t. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; rvd \<noteq> Some 0; if rvd = None then length x = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length x = unat (msgLength (messageInfoFromWord ret__unsigned_long)); (\<sigma>, xa) \<in> rf_sr; ret__unsigned_' t = msgLength (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < unat (msgLength (messageInfoFromWord ret__unsigned_long)) \<and> option_to_ptr rvd = NULL \<longrightarrow> unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length x) \<and> ((unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < unat (msgLength (messageInfoFromWord ret__unsigned_long)) \<longrightarrow> option_to_ptr rvd \<noteq> NULL) \<longrightarrow> unat (msgLength (messageInfoFromWord ret__unsigned_long)) = length x)
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. rvd \<noteq> Some 0 \<and> (if rvd = None then length a = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length a = unat (msgLength (messageInfoFromWord ret__unsigned_long)))\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. ?P7566 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (22 subgoals):
 1. \<And>ret__unsigned_long info a b rv' rvd rve ba x \<sigma> xa t. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; rvd \<noteq> Some 0; if rvd = None then length x = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length x = unat (msgLength (messageInfoFromWord ret__unsigned_long)); (\<sigma>, xa) \<in> rf_sr; ret__unsigned_' t = msgLength (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < unat (msgLength (messageInfoFromWord ret__unsigned_long)) \<and> option_to_ptr rvd = NULL \<longrightarrow> unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length x
 2. \<And>ret__unsigned_long info a b rv' rvd rve ba x \<sigma> xa t. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; rvd \<noteq> Some 0; if rvd = None then length x = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length x = unat (msgLength (messageInfoFromWord ret__unsigned_long)); (\<sigma>, xa) \<in> rf_sr; ret__unsigned_' t = msgLength (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < unat (msgLength (messageInfoFromWord ret__unsigned_long)) \<longrightarrow> option_to_ptr rvd \<noteq> NULL) \<longrightarrow> unat (msgLength (messageInfoFromWord ret__unsigned_long)) = length x
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. rvd \<noteq> Some 0 \<and> (if rvd = None then length a = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length a = unat (msgLength (messageInfoFromWord ret__unsigned_long)))\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (22 subgoals):
 1. \<And>ret__unsigned_long info a b rv' rvd rve ba x \<sigma> xa t. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; rvd \<noteq> Some 0; if rvd = None then length x = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length x = unat (msgLength (messageInfoFromWord ret__unsigned_long)); (\<sigma>, xa) \<in> rf_sr; ret__unsigned_' t = msgLength (messageInfoFromWord ret__unsigned_long); unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < unat (msgLength (messageInfoFromWord ret__unsigned_long)); option_to_ptr rvd = NULL\<rbrakk> \<Longrightarrow> unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length x
 2. \<And>ret__unsigned_long info a b rv' rvd rve ba x \<sigma> xa t. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; rvd \<noteq> Some 0; if rvd = None then length x = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length x = unat (msgLength (messageInfoFromWord ret__unsigned_long)); (\<sigma>, xa) \<in> rf_sr; ret__unsigned_' t = msgLength (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < unat (msgLength (messageInfoFromWord ret__unsigned_long)) \<longrightarrow> option_to_ptr rvd \<noteq> NULL) \<longrightarrow> unat (msgLength (messageInfoFromWord ret__unsigned_long)) = length x
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. rvd \<noteq> Some 0 \<and> (if rvd = None then length a = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length a = unat (msgLength (messageInfoFromWord ret__unsigned_long)))\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (22 subgoals):
 1. \<And>ret__unsigned_long info a b rv' rvd rve ba x \<sigma> xa t aa. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; rvd \<noteq> Some 0; if rvd = None then length x = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length x = unat (msgLength (messageInfoFromWord ret__unsigned_long)); (\<sigma>, xa) \<in> rf_sr; ret__unsigned_' t = msgLength (messageInfoFromWord ret__unsigned_long); unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < unat (msgLength (messageInfoFromWord ret__unsigned_long)); option_to_ptr rvd = NULL; rvd = Some aa\<rbrakk> \<Longrightarrow> unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length x
 2. \<And>ret__unsigned_long info a b rv' rvd rve ba x \<sigma> xa t. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; rvd \<noteq> Some 0; if rvd = None then length x = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length x = unat (msgLength (messageInfoFromWord ret__unsigned_long)); (\<sigma>, xa) \<in> rf_sr; ret__unsigned_' t = msgLength (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < unat (msgLength (messageInfoFromWord ret__unsigned_long)) \<longrightarrow> option_to_ptr rvd \<noteq> NULL) \<longrightarrow> unat (msgLength (messageInfoFromWord ret__unsigned_long)) = length x
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. rvd \<noteq> Some 0 \<and> (if rvd = None then length a = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length a = unat (msgLength (messageInfoFromWord ret__unsigned_long)))\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>ret__unsigned_long info a b rv' rvd rve ba x \<sigma> xa t. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; rvd \<noteq> Some 0; if rvd = None then length x = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length x = unat (msgLength (messageInfoFromWord ret__unsigned_long)); (\<sigma>, xa) \<in> rf_sr; ret__unsigned_' t = msgLength (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < unat (msgLength (messageInfoFromWord ret__unsigned_long)) \<longrightarrow> option_to_ptr rvd \<noteq> NULL) \<longrightarrow> unat (msgLength (messageInfoFromWord ret__unsigned_long)) = length x
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. rvd \<noteq> Some 0 \<and> (if rvd = None then length a = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length a = unat (msgLength (messageInfoFromWord ret__unsigned_long)))\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. ?P7566 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>ret__unsigned_long info a b rv' rvd rve ba x \<sigma> xa t. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; rvd \<noteq> Some 0; if rvd = None then length x = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length x = unat (msgLength (messageInfoFromWord ret__unsigned_long)); (\<sigma>, xa) \<in> rf_sr; ret__unsigned_' t = msgLength (messageInfoFromWord ret__unsigned_long); unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < unat (msgLength (messageInfoFromWord ret__unsigned_long)) \<longrightarrow> option_to_ptr rvd \<noteq> NULL\<rbrakk> \<Longrightarrow> unat (msgLength (messageInfoFromWord ret__unsigned_long)) = length x
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. rvd \<noteq> Some 0 \<and> (if rvd = None then length a = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length a = unat (msgLength (messageInfoFromWord ret__unsigned_long)))\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. ?P7566 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>ret__unsigned_long info a b rv' rvd rve ba x \<sigma> xa t aa. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; rvd \<noteq> Some 0; if rvd = None then length x = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length x = unat (msgLength (messageInfoFromWord ret__unsigned_long)); (\<sigma>, xa) \<in> rf_sr; ret__unsigned_' t = msgLength (messageInfoFromWord ret__unsigned_long); unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < unat (msgLength (messageInfoFromWord ret__unsigned_long)) \<longrightarrow> option_to_ptr rvd \<noteq> NULL; rvd = Some aa\<rbrakk> \<Longrightarrow> unat (msgLength (messageInfoFromWord ret__unsigned_long)) = length x
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. rvd \<noteq> Some 0 \<and> (if rvd = None then length a = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length a = unat (msgLength (messageInfoFromWord ret__unsigned_long)))\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. ?P7566 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. rvd \<noteq> Some 0 \<and> (if rvd = None then length a = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length a = unat (msgLength (messageInfoFromWord ret__unsigned_long)))\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. ?P7566 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (19 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P7566 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. rvd \<noteq> Some 0 \<and> (if rvd = None then length a = min (unat n_msgRegisters) (unat (msgLength (messageInfoFromWord ret__unsigned_long))) else length a = unat (msgLength (messageInfoFromWord ret__unsigned_long)))\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. ?P7566 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
A total of 19 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (18 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (getMRs rv rvd (messageInfoFromWord ret__unsigned_long))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (17 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> length___unsigned_long_' rv'b t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (?d'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rv'b)
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer,rv'b);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> ?Q'7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s)}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (seL4_MessageInfo_lift info)\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf) (?G'8061 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned) [SKIP] (do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
v <- invocationCatch rv isBlocking isCall id v;
case v of Inl (Inl syserr) \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inl (Inr xa) \<Rightarrow> throwError xa | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (\<acute>status :== CALL decodeInvocation_'proc(ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer,rv'b);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'8061 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s) v}}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7555 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf) (?G'8061 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))) [SKIP] (do y <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id;
case y of Inl (Inl syserr) \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inl (Inr xa) \<Rightarrow> throwError xa | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) (\<acute>status :== CALL decodeInvocation_'proc(label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)),cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer,rv'b);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>?Q7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'8061 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s) v}}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (22 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> ccorres (?f'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned \<currency> ?r'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned) (liftxf (?es8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned) (?ef'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned) (?vf'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned) (?xf'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned)) (?P8343 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf) (?G'8061 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))) [] (global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id) (\<acute>status :== CALL decodeInvocation_'proc(label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)),cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer,rv'b))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned) rv'c t t' (IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c)
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); ?r'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg (?vf'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c); ?ef'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg) (?Q'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c) [SKIP] (liftE (replyOnRestart rv [] isCall)) (?d'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c)
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); ?ef'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err (?ef'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (?d'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c)
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>?Q8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvg rv'c. ?r'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg (?vf'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c)) (?xf'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned) (\<lambda>rvg rv'c. {s. ?ef'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvg. ?f'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err (?ef'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg)) (?es8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned) (\<lambda>rvg rv'c. {s. ?ef'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned (?xf'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. ?P8343 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'8061 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf (length___unsigned_long_' s) v}}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c t t'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> status_' rv'c t t' (IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c)
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); dc rvg (K () rv'c); id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg) (?Q'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c) [SKIP] (liftE (replyOnRestart rv [] isCall)) (?d'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c)
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (?d'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c)
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>?Q8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); dc rvg (K () rv'c); id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg) (?Q'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c) [SKIP] (liftE (replyOnRestart rv [] isCall)) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>?Q8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8337 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) ()) (?Q'8337 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0) [SKIP] (do state <- getThreadState rv;
r <- when (state = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>?Q8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A8719 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) ()) (?C'8716 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0) [SKIP] (do state <- getThreadState rv;
r <- when (state = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C''])));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. ?A8719 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?C'8716 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rv'c rvg. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?P8724 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () a rvg) (?P'8725 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C''])));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> ?P8724 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa ts) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'8725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8732 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?G'8741 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg ret__unsigned \<inter> \<lbrace>ret__unsigned = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace>) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> ?P8732 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'8741 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8732 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?G'8905 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg ret__unsigned) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> ?P8732 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> ?G'8905 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8732 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?G'8909 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg ret__unsigned) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> ?P8732 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> ?G'8909 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8732 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?G'8909 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (IF rvg = Structures_H.thread_state.Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> ?P8732 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> ?G'8909 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8920 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?S8923 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?Q8920 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?S8923 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8920 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?S8923 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
(CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> ?Q8920 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?S8923 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (22 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8937 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?S8940 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (CALL replyFromKernel_success_empty_'proc(thread);;
(CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8936 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8938 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
(CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ?Q8937 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa) \<and> (\<not> isCall \<longrightarrow> ?R8936 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> ?S8940 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T8938 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (22 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8937 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () Structures_H.thread_state.Restart) (?S8940 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 Structures_H.thread_state.Restart (SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) [SKIP] (do _ <- replyFromKernel rv (0, []);
r <- setThreadState Structures_H.thread_state.Running rv;
return (Inr ())
od) (CALL replyFromKernel_success_empty_'proc(thread);;
(CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8936 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8938 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
(CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ?Q8937 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa) \<and> (\<not> isCall \<longrightarrow> ?R8936 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> ?S8940 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T8938 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (23 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned rvh xfdc. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; isCall; dc rvh xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8951 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned rvh) (?Q'8965 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b rvh xfdc) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running rv;
return (Inr ())
od) (CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R8959 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () Structures_H.thread_state.Restart\<rbrace> replyFromKernel rv (0, []) \<lbrace>?Q8951 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8936 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8938 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
(CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and ?R8959 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts) aa) \<and> (\<not> isCall \<longrightarrow> ?R8936 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvh. dc rvh (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'8964 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v t rvh}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T8938 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
A total of 23 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b t rva. ?Q'8965 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b rva (xfdc t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b. ?Q'8964 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 Structures_H.thread_state.Restart (SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (24 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned rvh xfdca rvi xfdc. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; isCall; dc rvh xfdca; dc rvi xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9013 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned rvh xfdca rvi) (?Q'9031 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b rvh xfdca rvi xfdc) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned rvh xfdc. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; isCall; dc rvh xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R9026 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned rvh\<rbrace> setThreadState Structures_H.thread_state.Running rv \<lbrace>?Q9013 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned rvh xfdc\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R8959 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () Structures_H.thread_state.Restart\<rbrace> replyFromKernel rv (0, []) \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R9026 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned a\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8936 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8938 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
(CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and ?R8959 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts) aa) \<and> (\<not> isCall \<longrightarrow> ?R8936 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvh. dc rvh (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>ta rvi. dc rvi (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'9032 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v t rvh ta rvi}}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T8938 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
A total of 24 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b. ?Q'9032 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 Structures_H.thread_state.Restart (SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b t rva ta rvb. ?Q'9031 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b rva (xfdc t) rvb (xfdc ta)
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (23 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned rvh xfdc. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; isCall; dc rvh xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R9026 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned rvh\<rbrace> setThreadState Structures_H.thread_state.Running rv \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R8959 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () Structures_H.thread_state.Restart\<rbrace> replyFromKernel rv (0, []) \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R9026 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned a\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8936 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8938 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
(CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and ?R8959 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts) aa) \<and> (\<not> isCall \<longrightarrow> ?R8936 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvg (K rvg rv'c)\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T8938 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
A total of 23 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (22 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?P'9094 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () (ds_id Structures_H.thread_state.Restart)\<rbrace> replyFromKernel rv (0, []) \<lbrace>\<lambda>rva s. Invariants_H.valid_queues s \<and> (valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Running s \<and> (ksSchedulerAction s = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues s p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction s) s) \<and> True\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8936 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8938 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
(CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>aa. tcb_at' rv aa \<and> ?P'9094 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) aa) \<and> (\<not> isCall \<longrightarrow> ?R8936 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvg (K rvg rv'c)\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T8938 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (22 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned rvh s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; isCall; invs' s\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues s \<and> (valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Running s \<and> (ksSchedulerAction s = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues s p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction s) s) \<and> True
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8936 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8938 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
(CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) aa) \<and> (\<not> isCall \<longrightarrow> ?R8936 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvg (K rvg rv'c)\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T8938 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8936 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8938 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
(CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) aa) \<and> (\<not> isCall \<longrightarrow> ?R8936 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvg (K rvg rv'c)\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T8938 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) false; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8936 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) false) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () Structures_H.thread_state.Restart) (?T8938 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) false) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 Structures_H.thread_state.Restart (SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running rv;
return (Inr ())
od) (CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) aa) \<and> (\<not> isCall \<longrightarrow> ?R8936 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvg (K rvg rv'c)\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T8938 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (22 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned rvh xfdc. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) false; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; \<not> isCall; dc rvh xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9129 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned rvh) (?Q'9143 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b rvh xfdc) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) false; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R9137 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) false) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () Structures_H.thread_state.Restart\<rbrace> setThreadState Structures_H.thread_state.Running rv \<lbrace>?Q9129 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) aa) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R9137 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts) aa)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvg (K rvg rv'c)\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvh. dc rvh (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'9142 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v t rvh})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b t rva. ?Q'9143 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b rva (xfdc t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b. ?Q'9142 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) false) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 Structures_H.thread_state.Restart (SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) false; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; rvg = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R9137 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) false) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () Structures_H.thread_state.Restart\<rbrace> setThreadState Structures_H.thread_state.Running rv \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) aa) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R9137 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts) aa)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvg (K rvg rv'c)\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvg (K rvg rv'c)\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (do r <- when (rvg = Structures_H.thread_state.Restart) (do _ <- when isCall (replyFromKernel rv (0, []));
setThreadState Structures_H.thread_state.Running rv
od);
return (Inr ())
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) aa) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) aa)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvg (K rvg rv'c)\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvg (K rvg rv'c)\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigneda rv'c rvg ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigneda = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); rv'c = 0; ret__unsigned = thread_state_to_tsType rvg; rvg \<noteq> Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8919 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () rvg) (?T8921 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) () 0 rvg (thread_state_to_tsType rvg)) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>ts. st_tcb_at' ((=) ts) rv aa \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) aa) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) aa)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> ?R8919 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a ts aa)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rvg rv'c. {s. id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvg (K rvg rv'c)\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvg (K rvg rv'c)\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> ?T8921 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg rv'c ts v)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (19 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err) (?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err') [SKIP] (case err of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>?QE8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''8337 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
A total of 19 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inl x1\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9226 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err x1) (?R''9214 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x1) [SKIP] (liftE (when isCall (replyFromKernel rv (msgFromSyscallError x1)))) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> ?R9226 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> ?R''9214 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9226 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?R''9214 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (liftE (when isCall (replyFromKernel rv (msgFromSyscallError x1)))) (Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> ?R9226 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> ?R''9214 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9226 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?R''9214 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (liftE (when isCall (replyFromKernel rv (msgFromSyscallError x1)))) (Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> ?R9226 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> ?R''9214 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9226 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?R''9214 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (do r <- when isCall (replyFromKernel rv (msgFromSyscallError x1));
return (Inr ())
od) (IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
(return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> ?R9226 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> ?R''9214 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9271 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?S9274 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (do r <- when isCall (replyFromKernel rv (msgFromSyscallError x1));
return (Inr ())
od) (CALL replyFromKernel_error_'proc(thread);;
(return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9270 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?T9272 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (do r <- when isCall (replyFromKernel rv (msgFromSyscallError x1));
return (Inr ())
od) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> ?Q9271 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa) \<and> (\<not> isCall \<longrightarrow> ?R9270 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa)) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> ?S9274 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T9272 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9271 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?S9274 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (do r <- replyFromKernel rv (msgFromSyscallError x1);
return (Inr ())
od) (CALL replyFromKernel_error_'proc(thread);;
(return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond UNIV (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9270 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?T9272 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (do r <- when isCall (replyFromKernel rv (msgFromSyscallError x1));
return (Inr ())
od) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> ?Q9271 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa) \<and> (\<not> isCall \<longrightarrow> ?R9270 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa)) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> ?S9274 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T9272 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (22 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1 rvg xfdc. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; isCall; dc rvg xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9285 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1 rvg) (?Q'9299 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1 rvg xfdc) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond UNIV (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R9293 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1\<rbrace> replyFromKernel rv (msgFromSyscallError x1) \<lbrace>?Q9285 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9270 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?T9272 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (do r <- when isCall (replyFromKernel rv (msgFromSyscallError x1));
return (Inr ())
od) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> (valid_pspace' and tcb_at' rv and ?R9293 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x) aa) \<and> (\<not> isCall \<longrightarrow> ?R9270 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa)) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvh. dc rvh (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'9298 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x t rvh}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T9272 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1 t rva. ?Q'9299 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1 rva (xfdc t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1. ?Q'9298 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (23 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1 rvg xfdc. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; isCall; dc rvg xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9285 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1 rvg) (?P'9351 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1 rvg xfdc) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1 rvg xfdc. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; isCall; dc rvg xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9350 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1 rvg xfdc) return_C ret__unsigned_long_'_update (\<lambda>a. 0) {},UNIV
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R9293 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1\<rbrace> replyFromKernel rv (msgFromSyscallError x1) \<lbrace>?Q9285 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9270 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?T9272 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (do r <- when isCall (replyFromKernel rv (msgFromSyscallError x1));
return (Inr ())
od) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> (valid_pspace' and tcb_at' rv and ?R9293 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x) aa) \<and> (\<not> isCall \<longrightarrow> ?R9270 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa)) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvh. dc rvh (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'9348 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x t rvh \<inter> ?R'9347 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x t rvh}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T9272 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
A total of 23 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1 t rva. ?P'9351 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1 rva (xfdc t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1. ?P'9348 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1 t rva. ?R'9350 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1 rva (xfdc t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1. ?R'9347 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (22 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1 rvg xfdc. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; isCall; dc rvg xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9350 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1 rvg xfdc) return_C ret__unsigned_long_'_update (\<lambda>a. 0) {},UNIV
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R9293 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1\<rbrace> replyFromKernel rv (msgFromSyscallError x1) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9270 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?T9272 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (do r <- when isCall (replyFromKernel rv (msgFromSyscallError x1));
return (Inr ())
od) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> (valid_pspace' and tcb_at' rv and ?R9293 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x) aa) \<and> (\<not> isCall \<longrightarrow> ?R9270 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa)) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvh. dc rvh (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> ?R'9347 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x t rvh}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T9272 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
A total of 22 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1 t rva. ?R'9350 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1 rva (xfdc t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf rv'b err' x1. ?R'9347 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) true; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R9293 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) true) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1\<rbrace> replyFromKernel rv (msgFromSyscallError x1) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9270 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?T9272 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (do r <- when isCall (replyFromKernel rv (msgFromSyscallError x1));
return (Inr ())
od) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> (valid_pspace' and tcb_at' rv and ?R9293 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x) aa) \<and> (\<not> isCall \<longrightarrow> ?R9270 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa)) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T9272 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9270 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?T9272 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (do r <- when isCall (replyFromKernel rv (msgFromSyscallError x1));
return (Inr ())
od) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0)))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> (valid_pspace' and tcb_at' rv and (\<lambda>a. True)) aa) \<and> (\<not> isCall \<longrightarrow> ?R9270 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa)) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T9272 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) false; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9270 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) false) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?T9272 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) false) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. 0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond {} (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. 0))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> (valid_pspace' and tcb_at' rv and (\<lambda>a. True)) aa) \<and> (\<not> isCall \<longrightarrow> ?R9270 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa)) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?T9272 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (21 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) false; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9270 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) false) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) x1) (?P'9372 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) false) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. 0))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) false; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; \<not> isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9371 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) false) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) return_C ret__unsigned_long_'_update (\<lambda>a. 0) {},UNIV
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> (valid_pspace' and tcb_at' rv and (\<lambda>a. True)) aa) \<and> (\<not> isCall \<longrightarrow> ?R9270 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa)) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> ?P'9372 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x \<inter> ?R'9371 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err err' x1. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = SCAST(32 signed \<rightarrow> 32) false; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = 0; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = 0; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); syscall_error_to_H (errsyscall err') (errlookup_fault err') = Some x1; err = Inl x1; \<not> isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9371 (from_bool isBlocking) (SCAST(32 signed \<rightarrow> 32) false) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inl x1) 3 err' x1) return_C ret__unsigned_long_'_update (\<lambda>a. 0) {},UNIV
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> (valid_pspace' and tcb_at' rv and (\<lambda>a. True)) aa) \<and> (\<not> isCall \<longrightarrow> True)) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> ?R'9371 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (19 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); id rv'c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; intr_and_se_rel err (id rv'c) err'; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err a x2) (?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2) [SKIP] (throwError x2) (IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'c)
FI;;
(IF rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> (valid_pspace' and tcb_at' rv and (\<lambda>a. True)) aa) \<and> (\<not> isCall \<longrightarrow> True)) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
A total of 19 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (19 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); EXCEPTION_PREEMPTED \<noteq> EXCEPTION_NONE; rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R9222 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inr x2) a x2) (?R''9212 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inr x2) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED) err' x2) [SKIP] (throwError x2) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED);;
(Cond (if EXCEPTION_PREEMPTED = EXCEPTION_SYSCALL_ERROR then UNIV else {}) (Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) SKIP;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> (valid_pspace' and tcb_at' rv and (\<lambda>a. True)) aa) \<and> (\<not> isCall \<longrightarrow> True)) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9222 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a aa x)\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?R''9212 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
A total of 19 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); EXCEPTION_PREEMPTED \<noteq> EXCEPTION_NONE; rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED; err = Inr x2\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9395 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inr x2) x2) (?P'9393 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inr x2) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED) err' x2) [SKIP] (throwError x2) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); EXCEPTION_PREEMPTED \<noteq> EXCEPTION_NONE; rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED; err = Inr x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9392 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inr x2) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED) err' x2) return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED) {},UNIV
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> (valid_pspace' and tcb_at' rv and (\<lambda>a. True)) aa) \<and> (\<not> isCall \<longrightarrow> True)) \<and> (\<forall>x. a = Inr x \<longrightarrow> ?R9395 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned a x aa)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> ?P'9393 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x \<inter> ?R'9392 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (19 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rv'c err' x2. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); EXCEPTION_PREEMPTED \<noteq> EXCEPTION_NONE; rv'c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED; err = Inr x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9392 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf rv'b (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))) (Inr x2) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED) err' x2) return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED) {},UNIV
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> (valid_pspace' and tcb_at' rv and (\<lambda>a. True)) aa) \<and> (\<not> isCall \<longrightarrow> True)) \<and> (\<forall>x. a = Inr x \<longrightarrow> True)\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rvg rv'c. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> {s. id rvg \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> K dc x (id rvg) (errstate s)} \<inter> ?R'9392 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err rvg rv'c x}}})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
A total of 19 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (18 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve >>= invocationCatch rv isBlocking isCall id \<lbrace>\<lambda>a. (\<lambda>a. \<forall>ts. st_tcb_at' ((=) ts) rv a \<longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' rv a \<and> (invs' and tcb_at' rv) a)) a) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' rv a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread rv \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. rv \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) a)) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> True)) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)\<rbrace>, \<lbrace>\<lambda>a aa. (\<forall>x. a = Inl x \<longrightarrow> (isCall \<longrightarrow> (valid_pspace' and tcb_at' rv and (\<lambda>a. True)) aa) \<and> (\<not> isCall \<longrightarrow> True)) \<and> (\<forall>x. a = Inr x \<longrightarrow> True)\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rva rv'. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> {s. id rva \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> K dc x (id rva) (errstate s)} \<inter> \<lbrace>True\<rbrace>}}})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (18 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
case v of Inl x \<Rightarrow> throwError (Inl x) | Inr oper \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart rv);
reply <- global.performInvocation isBlocking isCall oper >>= case_sum (\<lambda>x. throwError (Inr x)) returnOk;
liftE (if reply = [] then replyOnRestart rv [] isCall \<sqinter> return () else replyOnRestart rv reply isCall)
odE
od \<lbrace>\<lambda>a b. (st_tcb_at' ((=) Structures_H.thread_state.Restart) rv b \<longrightarrow> (isCall \<longrightarrow> tcb_at' rv b \<and> invs' b \<and> tcb_at' rv b) \<and> (\<not> isCall \<longrightarrow> tcb_at' rv b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b)) \<and> tcb_at' (ctcb_ptr_to_tcb_ptr thread) b\<rbrace>, \<lbrace>\<lambda>a aa. (\<exists>x. a = Inl x) \<longrightarrow> isCall \<longrightarrow> valid_pspace' aa \<and> tcb_at' rv aa\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rva rv'. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> {s. id rva \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> K dc x (id rva) (errstate s)} \<inter> \<lbrace>True\<rbrace>}}})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (20 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> \<lbrace>?R8341 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf\<rbrace> do v <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) rvf cptr (snd rvc) (fst rvc) rve;
case v of Inl x \<Rightarrow> throwError (Inl x) | Inr oper \<Rightarrow> doE y <- liftE (setThreadState Structures_H.thread_state.Restart rv);
reply <- global.performInvocation isBlocking isCall oper >>= case_sum (\<lambda>x. throwError (Inr x)) returnOk;
liftE (if reply = [] then replyOnRestart rv [] isCall \<sqinter> return () else replyOnRestart rv reply isCall)
odE
od \<lbrace>\<lambda>rv'. invs' and tcb_at' rv\<rbrace>, \<lbrace>\<lambda>ft. invs' and tcb_at' rv\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); (invs' and tcb_at' rv) s\<rbrakk> \<Longrightarrow> (st_tcb_at' ((=) Structures_H.thread_state.Restart) rv s \<longrightarrow> (isCall \<longrightarrow> tcb_at' rv s \<and> invs' s \<and> tcb_at' rv s) \<and> (\<not> isCall \<longrightarrow> tcb_at' rv s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s)) \<and> tcb_at' (ctcb_ptr_to_tcb_ptr thread) s
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned e s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); (invs' and tcb_at' rv) s\<rbrakk> \<Longrightarrow> (\<exists>x. e = Inl x) \<longrightarrow> isCall \<longrightarrow> valid_pspace' s \<and> tcb_at' rv s
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rva rv'. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> {s. id rva \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> K dc x (id rva) (errstate s)} \<inter> \<lbrace>True\<rbrace>}}})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and ?R8341 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (19 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned rvg s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); (invs' and tcb_at' rv) s\<rbrakk> \<Longrightarrow> (st_tcb_at' ((=) Structures_H.thread_state.Restart) rv s \<longrightarrow> (isCall \<longrightarrow> tcb_at' rv s \<and> invs' s \<and> tcb_at' rv s) \<and> (\<not> isCall \<longrightarrow> tcb_at' rv s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s)) \<and> tcb_at' (ctcb_ptr_to_tcb_ptr thread) s
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned e s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); (invs' and tcb_at' rv) s\<rbrakk> \<Longrightarrow> (\<exists>x. e = Inl x) \<longrightarrow> isCall \<longrightarrow> valid_pspace' s \<and> tcb_at' rv s
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rva rv'. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> {s. id rva \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> K dc x (id rva) (errstate s)} \<inter> \<lbrace>True\<rbrace>}}})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and (\<lambda>a. (invs' and tcb_at' rv) a \<and> True \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a)\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
A total of 19 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (18 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned e s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)); (invs' and tcb_at' rv) s\<rbrakk> \<Longrightarrow> (\<exists>x. e = Inl x) \<longrightarrow> isCall \<longrightarrow> valid_pspace' s \<and> tcb_at' rv s
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rva rv'. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> {s. id rva \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> K dc x (id rva) (errstate s)} \<inter> \<lbrace>True\<rbrace>}}})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and (\<lambda>a. (invs' and tcb_at' rv) a \<and> True \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a)\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (17 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. dc rv (K () rv')) status_' (\<lambda>rva rv'. {s. id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>ts tcb'. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. \<forall>v. v = tsType_CL (thread_state_lift (thread_state_' (thread_state_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = tsType_CL (thread_state_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. (ts = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>}}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>})}) \<and> (ts \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> \<lbrace>id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rva rv')\<rbrace>)} \<inter> \<lbrace>v = thread_state_to_tsType ts\<rbrace>}}} \<inter> \<lbrace>True\<rbrace>})
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rva rv'. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> {s. id rva \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> K dc x (id rva) (errstate s)} \<inter> \<lbrace>True\<rbrace>}}})
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and (\<lambda>a. (invs' and tcb_at' rv) a \<and> True \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (17 subgoals):
 1. \<And>rv ret__unsigned_long info a b rv' rve ba rvf rv'b s ts tcb'. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; unat rv'b = length rvf; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; status_' s = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb'; cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb')\<rbrakk> \<Longrightarrow> (ts = Structures_H.thread_state.Restart \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Running) \<and> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = thread_state_to_tsType ts
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rva rv'. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> {s. id rva \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> K dc x (id rva) (errstate s)} \<inter> \<lbrace>True\<rbrace>}}})
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and (\<lambda>a. (invs' and tcb_at' rv) a \<and> True \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (17 subgoals):
 1. \<And>rv ret__unsigned_long info a b rv' rve ba rvf rv'b s ts tcb'. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; unat rv'b = length rvf; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; status_' s = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb'; cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb')\<rbrakk> \<Longrightarrow> tsType_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr rv\<rightarrow>[''tcbState_C''])))) = thread_state_to_tsType ts
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rva rv'. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> {s. id rva \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> K dc x (id rva) (errstate s)} \<inter> \<lbrace>True\<rbrace>}}})
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and (\<lambda>a. (invs' and tcb_at' rv) a \<and> True \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (17 subgoals):
 1. \<And>rv ret__unsigned_long info a b rv' rve ba rvf rv'b s ts tcb'. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; unat rv'b = length rvf; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; status_' s = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cslift s (tcb_ptr_to_ctcb_ptr rv) = Some tcb'; cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb')\<rbrakk> \<Longrightarrow> tsType_CL (thread_state_lift (tcbState_C tcb')) = thread_state_to_tsType ts
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rva rv'. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> {s. id rva \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> K dc x (id rva) (errstate s)} \<inter> \<lbrace>True\<rbrace>}}})
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and (\<lambda>a. (invs' and tcb_at' rv) a \<and> True \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
A total of 17 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf rv'b ret__unsigned err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat rv'b = length rvf; ret__unsigned = label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. intr_and_se_rel err (id rv)) errstate (\<lambda>rva rv'. {s. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. err = Inl x \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some x\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> \<lbrace>id 0 = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>)}}} \<inter> {s. \<forall>x. s \<in> {s. err = Inr x \<longrightarrow> s \<in> {s. id rva \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> K dc x (id rva) (errstate s)} \<inter> \<lbrace>True\<rbrace>}}})
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and (\<lambda>a. (invs' and tcb_at' rv) a \<and> True \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a)\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (16 subgoals):
 1. \<And>ret__unsigned_long info a b rv' rve ba rvf rv'b err s rvc. \<lbrakk>seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; interpret_excaps ba = excaps_map rve; unat rv'b = length rvf; ccap_relation a (lookupCapAndSlot_ret_C.cap_C rv'); lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr b; intr_and_se_rel err rvc (errstate s); status_' s \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> (\<forall>x. err = Inl x \<longrightarrow> (isCall \<longrightarrow> syscall_error_to_H (current_syscall_error_' (globals s)) (lookup_fault_lift (current_lookup_fault_' (globals s))) = Some x \<and> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = 0) \<and> (\<not> isCall \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = 0)) \<and> ((\<exists>x. err = Inr x) \<longrightarrow> rvc \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and (\<lambda>a. (invs' and tcb_at' rv) a \<and> True \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a)\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = rv) and ct_active' and sch_act_simple and valid_cap' (fst rvc) and (\<lambda>s. \<forall>x\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' x s) and excaps_in_mem rve \<circ> ctes_of and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and (\<lambda>s. \<forall>v\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set rve. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel a (?buffer8368 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a a) and (\<lambda>a. (invs' and tcb_at' rv) a \<and> True \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> True) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> sch_act_simple a \<and> (\<forall>x. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> rv) \<and> ksCurThread a \<notin> set (ksReadyQueues a x)) \<and> (tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a) \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> (invs' a \<and> st_tcb_at' simple' rv a \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' rv a) \<and> (rv = ksIdleThread a \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple a) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. rv \<notin> set (ksReadyQueues a p)))) \<and> active' Structures_H.thread_state.Restart \<and> (valid_cap' (fst rvc) and invs' and sch_act_simple and cte_wp_at' ((=) (fst rvc) \<circ> cteCap) (snd rvc) and real_cte_at' (snd rvc) and (\<lambda>s. \<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>r\<in>cte_refs' (fst rvc) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. valid_cap' (fst x) s) and (\<lambda>s. \<forall>x\<in>set rve. real_cte_at' (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) s) and (\<lambda>s. \<forall>x\<in>set rve. cte_wp_at' (badge_derived' (fst x) \<circ> cteCap) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) a \<and> tcb_at' rv a \<and> active' Structures_H.thread_state.Restart \<and> rv = ksCurThread a)\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R7564 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve\<rbrace> getMRs rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem rve (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set rve. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set rve. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set rve. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set rve. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set rve. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set rve. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set rve. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set rve. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> sysargs_rel a (?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a a) aa \<and> st_tcb_at' simple' rv aa\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rvf. unat (length___unsigned_long_' s) = length rvf \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rvf\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr (?buffer8367 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a rvf v)\<rbrace>}}}
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and ?R7564 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr. ?buffer8368 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer rve rv'a rvf. ?buffer8367 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a rvf (label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)))
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI {s. \<forall>rv. unat (length___unsigned_long_' s) = length rv \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>invLabel_' := v, capIndex_' := cptr, slot_' := lookupCapAndSlot_ret_C.slot_C rv', cap_' := lookupCapAndSlot_ret_C.cap_C rv', block_' := isBlockinga, call_' := isCalla, buffer_' := buffer, length___unsigned_long_' := length___unsigned_long_' s\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>call = isCalla\<rbrace> \<inter> \<lbrace>\<acute>block = isBlockinga\<rbrace> \<inter> \<lbrace>\<acute>invLabel = msgLabel rva\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length rv\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd rvc)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = snd rv'a\<rbrace> \<inter> \<lbrace>ccap_relation (fst rvc) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr rvd\<rbrace>}}}
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; interpret_excaps (snd rv'a) = excaps_map rve; fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7555 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a\<^esub> (?R'7558 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer rve rv'a) \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI \<lbrace>(\<exists>rv. unat \<acute>length___unsigned_long = length rv) \<longrightarrow> label_CL (mi_from_H (messageInfoFromWord ret__unsigned_long)) = msgLabel (messageInfoFromWord ret__unsigned_long) \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rve rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> ?R'7558 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer rve rv'a})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err) (?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer (messageInfoFromWord ret__unsigned_long);
x <- global.decodeInvocation (msgLabel (messageInfoFromWord ret__unsigned_long)) args cptr slot cap extracaps;
a <- invocationCatch rv isBlocking isCall id x;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,buffer,\<acute>length___unsigned_long);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?Q''7005 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (liftE (when isBlocking (handleFault rv err))) (Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?Q''7005 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (liftE (when isBlocking (handleFault rv err))) (Cond (if isBlocking then UNIV else {}) (CALL handleFault_'proc(thread)) SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7005 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?Q''7005 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (liftE (when isBlocking (handleFault rv err))) (IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>?QE7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''7005 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); isBlocking\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q10175 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?S10178 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (liftE (when isBlocking (handleFault rv err))) (CALL handleFault_'proc(thread);;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10174 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?T10176 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (liftE (when isBlocking (handleFault rv err))) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>\<lambda>a aa. (isBlocking \<longrightarrow> ?Q10175 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a aa) \<and> (\<not> isBlocking \<longrightarrow> ?R10174 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a aa)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S10178 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T10176 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a)}})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = SCAST(32 signed \<rightarrow> 32) true; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); isBlocking\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q10175 (SCAST(32 signed \<rightarrow> 32) true) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?S10178 (SCAST(32 signed \<rightarrow> 32) true) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (do r <- handleFault rv err;
return (Inr ())
od) (CALL handleFault_'proc(thread);;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',SCAST(32 signed \<rightarrow> 32) true,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10174 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?T10176 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (liftE (when isBlocking (handleFault rv err))) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>\<lambda>a aa. (isBlocking \<longrightarrow> ?Q10175 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a aa) \<and> (\<not> isBlocking \<longrightarrow> ?R10174 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a aa)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> ?S10178 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T10176 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a)}})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err' rve xfdc. \<lbrakk>isBlockinga = SCAST(32 signed \<rightarrow> 32) true; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); isBlocking; dc rve xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q10189 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err' rve) (?Q'10203 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer err rv'a err' rve xfdc) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',SCAST(32 signed \<rightarrow> 32) true,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = SCAST(32 signed \<rightarrow> 32) true; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R10197 (SCAST(32 signed \<rightarrow> 32) true) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err\<rbrace> handleFault rv err \<lbrace>?Q10189 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10174 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?T10176 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (liftE (when isBlocking (handleFault rv err))) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>\<lambda>a aa. (isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and ?R10197 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a) aa) \<and> (\<not> isBlocking \<longrightarrow> ?R10174 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a aa)\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvf. dc rvf (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'10202 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a t rvf}) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T10176 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a)}})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer err rv'a err' t rva. ?Q'10203 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer err rv'a err' rva (xfdc t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr. ?Q'10202 (SCAST(32 signed \<rightarrow> 32) true) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (16 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err' rve xfdc. \<lbrakk>isBlockinga = SCAST(32 signed \<rightarrow> 32) true; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); isBlocking; dc rve xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q10189 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err' rve) (?P'10255 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer err rv'a err' rve xfdc) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err' rve xfdc. \<lbrakk>isBlockinga = SCAST(32 signed \<rightarrow> 32) true; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); isBlocking; dc rve xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10254 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer err rv'a err' rve xfdc) return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},UNIV
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = SCAST(32 signed \<rightarrow> 32) true; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R10197 (SCAST(32 signed \<rightarrow> 32) true) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err\<rbrace> handleFault rv err \<lbrace>?Q10189 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10174 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?T10176 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (liftE (when isBlocking (handleFault rv err))) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>\<lambda>a aa. (isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and ?R10197 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a) aa) \<and> (\<not> isBlocking \<longrightarrow> ?R10174 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a aa)\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvf. dc rvf (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'10252 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a t rvf \<inter> ?R'10251 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a t rvf}) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T10176 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a)}})
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer err rv'a err' t rva. ?P'10255 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer err rv'a err' rva (xfdc t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr. ?P'10252 (SCAST(32 signed \<rightarrow> 32) true) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer err rv'a err' t rva. ?R'10254 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer err rv'a err' rva (xfdc t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr. ?R'10251 (SCAST(32 signed \<rightarrow> 32) true) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (15 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err' rve xfdc. \<lbrakk>isBlockinga = SCAST(32 signed \<rightarrow> 32) true; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); isBlocking; dc rve xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10254 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer err rv'a err' rve xfdc) return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},UNIV
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = SCAST(32 signed \<rightarrow> 32) true; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R10197 (SCAST(32 signed \<rightarrow> 32) true) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err\<rbrace> handleFault rv err \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10174 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?T10176 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (liftE (when isBlocking (handleFault rv err))) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>\<lambda>a aa. (isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and ?R10197 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a) aa) \<and> (\<not> isBlocking \<longrightarrow> ?R10174 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a aa)\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rvf. dc rvf (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> ?R'10251 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a t rvf}) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T10176 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a)}})
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long info cptr rvc rv' rvd buffer err rv'a err' t rva. ?R'10254 rv thread ret__unsigned_long info cptr rvc rv' rvd buffer err rv'a err' rva (xfdc t) \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info cptr. ?R'10251 (SCAST(32 signed \<rightarrow> 32) true) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = SCAST(32 signed \<rightarrow> 32) true; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?R10197 (SCAST(32 signed \<rightarrow> 32) true) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err\<rbrace> handleFault rv err \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10174 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?T10176 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (liftE (when isBlocking (handleFault rv err))) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>\<lambda>a aa. (isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and ?R10197 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a) aa) \<and> (\<not> isBlocking \<longrightarrow> ?R10174 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a aa)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T10176 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a)}})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10174 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?T10176 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (liftE (when isBlocking (handleFault rv err))) (SKIP;;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>\<lambda>a aa. (isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) aa) \<and> (\<not> isBlocking \<longrightarrow> ?R10174 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a aa)\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T10176 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a)}})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = SCAST(32 signed \<rightarrow> 32) false; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10174 (SCAST(32 signed \<rightarrow> 32) false) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?T10176 (SCAST(32 signed \<rightarrow> 32) false) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',SCAST(32 signed \<rightarrow> 32) false,from_bool isCall,buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_error_'proc(thread)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  Cond (if isCall then UNIV else {}) (CALL replyFromKernel_success_empty_'proc(thread)) SKIP;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>\<lambda>a aa. (isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) aa) \<and> (\<not> isBlocking \<longrightarrow> ?R10174 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a aa)\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?T10176 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a)}})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = SCAST(32 signed \<rightarrow> 32) false; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); \<not> isBlocking\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10174 (SCAST(32 signed \<rightarrow> 32) false) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err) (?P'10276 (SCAST(32 signed \<rightarrow> 32) false) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = SCAST(32 signed \<rightarrow> 32) false; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); \<not> isBlocking\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10275 (SCAST(32 signed \<rightarrow> 32) false) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},UNIV
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>\<lambda>a aa. (isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) aa) \<and> (\<not> isBlocking \<longrightarrow> ?R10174 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer a aa)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isBlocking \<longrightarrow> s \<in> ?P'10276 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a \<inter> ?R'10275 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a)}})
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rv'a err'. \<lbrakk>isBlockinga = SCAST(32 signed \<rightarrow> 32) false; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer; fst rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err'); \<not> isBlocking\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10275 (SCAST(32 signed \<rightarrow> 32) false) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd buffer err rv'a err') return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},UNIV
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>\<lambda>a b. (isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) b) \<and> (\<not> isBlocking \<longrightarrow> True)\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rve rv'a. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isBlocking \<longrightarrow> s \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> ?R'10275 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err rve rv'a)}})
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a. (\<lambda>a. rvd \<noteq> Some 0 \<and> msgLength rva \<le> 0x78) and (\<lambda>aa. invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa \<and> cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> ((\<lambda>s. rv = ksCurThread s) and cur_tcb' and (case rvd of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and K (msgLength rva \<le> msgMaxLength)) aa \<and> st_tcb_at' simple' rv aa)\<rbrace>, \<lbrace>\<lambda>a b. (isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>a. True)) b) \<and> (\<not> isBlocking \<longrightarrow> True)\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rva rv'. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isBlocking \<longrightarrow> s \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>)}})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 10. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R7009 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc rv' rvd\<rbrace> lookupExtraCaps rv rvd (messageInfoFromWord ret__unsigned_long) \<lbrace>\<lambda>a aa. rvd \<noteq> Some 0 \<and> msgLength (messageInfoFromWord ret__unsigned_long) \<le> 0x78 \<and> invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> excaps_in_mem a (ctes_of aa) \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> (\<forall>x\<in>set a. valid_cap' (fst x) aa) \<and> (\<forall>x\<in>set a. ex_cte_cap_wp_to' isCNodeCap (snd x) aa) \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> (\<forall>x\<in>set a. real_cte_at' (snd x) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>zobj_refs' (fst cap). ex_nonz_cap_to' r aa) \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. badge_derived' (fst x) (cteCap a)) (snd x) aa) \<and> (\<forall>x\<in>set a. cte_wp_at' (\<lambda>a. fst x = cteCap a) (snd x) aa) \<and> (\<forall>v\<in>set a. valid_cap' (fst v) aa) \<and> (\<forall>v\<in>set a. cte_wp_at' (\<lambda>_. True) (snd v) aa) \<and> (\<forall>cap\<in>set a. \<forall>r\<in>cte_refs' (fst cap) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> rv = ksCurThread aa \<and> cur_tcb' aa \<and> (case rvd of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> msgLength (messageInfoFromWord ret__unsigned_long) \<le> msgMaxLength \<and> st_tcb_at' simple' rv aa\<rbrace>, \<lbrace>\<lambda>a b. isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rva rv'. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isBlocking \<longrightarrow> s \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>)}})
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and ?R7009 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 10. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. interpret_excaps (snd rv') = excaps_map rv) (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) (\<lambda>rv rv'a. {s. fst rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> rvd \<noteq> Some 0 \<and> (if rvd = None then length rv = min (unat n_msgRegisters) (unat (msgLength rva)) else length rv = unat (msgLength rva)) \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = length_CL (seL4_MessageInfo_lift info) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL \<longrightarrow> (\<exists>rv. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv')) \<and> (\<not> (SCAST(32 signed \<rightarrow> 32) n_msgRegisters < length_CL (seL4_MessageInfo_lift info) \<and> buffer = NULL) \<longrightarrow> (\<exists>rv. unat (length_CL (seL4_MessageInfo_lift info)) = length rv) \<longrightarrow> label_CL (mi_from_H rva) = msgLabel rva \<and> lookupCapAndSlot_ret_C.slot_C rv' = cte_Ptr (snd rvc) \<and> \<acute>current_extra_caps = snd rv'a \<and> ccap_relation (fst rvc) (lookupCapAndSlot_ret_C.cap_C rv'))\<rbrace>})
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rva rv'. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isBlocking \<longrightarrow> s \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>)}})
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and (\<lambda>aa. (isBlocking \<longrightarrow> invs' aa \<and> st_tcb_at' simple' rv aa \<and> sch_act_not rv aa \<and> (\<forall>aaa b. rv \<notin> set (ksReadyQueues aa (aaa, b)))) \<and> a \<noteq> Some 0 \<and> msgLength rva \<le> 0x78 \<and> invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> True \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> valid_objs' aa \<and> (invs' and K (\<forall>cap. isCNodeCap cap \<longrightarrow> isCNodeCap cap)) aa \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> valid_objs' aa \<and> invs' aa \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> invs' aa \<and> True \<and> valid_objs' aa \<and> valid_objs' aa \<and> invs' aa \<and> rv = ksCurThread aa \<and> cur_tcb' aa \<and> (case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) aa \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv aa)\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 9. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 10. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv' rvd buffer err. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>(c', s'). ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; option_to_ptr rvd = buffer\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv a. cfault_rel (Some err) (errfault a) (errlookup_fault a)) errstate (\<lambda>rva rv'. {s. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. (isBlocking \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isBlocking \<longrightarrow> s \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>)}})
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and (\<lambda>aa. (isBlocking \<longrightarrow> invs' aa \<and> st_tcb_at' simple' rv aa \<and> sch_act_not rv aa \<and> (\<forall>aaa b. rv \<notin> set (ksReadyQueues aa (aaa, b)))) \<and> a \<noteq> Some 0 \<and> msgLength rva \<le> 0x78 \<and> invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> True \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> valid_objs' aa \<and> (invs' and K (\<forall>cap. isCNodeCap cap \<longrightarrow> isCNodeCap cap)) aa \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> valid_objs' aa \<and> invs' aa \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> invs' aa \<and> True \<and> valid_objs' aa \<and> valid_objs' aa \<and> invs' aa \<and> rv = ksCurThread aa \<and> cur_tcb' aa \<and> (case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) aa \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv aa)\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 8. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 9. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 10. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a. valid_pspace' and tcb_at' rv and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps rva) \<le> 3) and (\<lambda>aa. (isBlocking \<longrightarrow> invs' aa \<and> st_tcb_at' simple' rv aa \<and> sch_act_not rv aa \<and> (\<forall>aaa b. rv \<notin> set (ksReadyQueues aa (aaa, b)))) \<and> a \<noteq> Some 0 \<and> msgLength rva \<le> 0x78 \<and> invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> True \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> valid_objs' aa \<and> (invs' and K (\<forall>cap. isCNodeCap cap \<longrightarrow> isCNodeCap cap)) aa \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> valid_objs' aa \<and> invs' aa \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> invs' aa \<and> True \<and> valid_objs' aa \<and> valid_objs' aa \<and> invs' aa \<and> rv = ksCurThread aa \<and> cur_tcb' aa \<and> (case a of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) aa \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv aa)\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 7. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 8. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 9. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr rvc rv'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; (case rvc of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C rv', lookupCapAndSlot_ret_C.slot_C rv'); lookupCapAndSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6364 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr rvc\<rbrace> lookupIPCBuffer False rv \<lbrace>\<lambda>a aa. valid_pspace' aa \<and> tcb_at' rv aa \<and> (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> unat (msgExtraCaps (messageInfoFromWord ret__unsigned_long)) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' aa \<and> st_tcb_at' simple' rv aa \<and> sch_act_not rv aa \<and> (\<forall>aaa b. rv \<notin> set (ksReadyQueues aa (aaa, b)))) \<and> a \<noteq> Some 0 \<and> msgLength (messageInfoFromWord ret__unsigned_long) \<le> 0x78 \<and> invs' aa \<and> sch_act_simple aa \<and> ex_nonz_cap_to' rv aa \<and> vs_valid_duplicates' (ksPSpace aa) \<and> rv = ksCurThread aa \<and> ksCurThread aa = rv \<and> valid_cap' (fst rvc) aa \<and> rv \<noteq> ksIdleThread aa \<and> tcb_at' rv aa \<and> real_cte_at' (snd rvc) aa \<and> (\<forall>r\<in>zobj_refs' (fst rvc). ex_nonz_cap_to' r aa) \<and> valid_objs' aa \<and> invs' aa \<and> ct_active' aa \<and> cte_wp_at' (\<lambda>a. fst rvc = cteCap a) (snd rvc) aa \<and> valid_objs' aa \<and> invs' aa \<and> (\<forall>r\<in>cte_refs' (fst rvc) (irq_node' aa). ex_cte_cap_wp_to' (\<lambda>_. True) r aa) \<and> (\<forall>aaa b. ksCurThread aa \<notin> set (ksReadyQueues aa (aaa, b))) \<and> invs' aa \<and> valid_objs' aa \<and> invs' aa \<and> rv = ksCurThread aa \<and> cur_tcb' aa \<and> (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> msgLength (messageInfoFromWord ret__unsigned_long) \<le> msgMaxLength \<and> st_tcb_at' simple' rv aa\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and ?R6364 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 7. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 8. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 9. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err) (?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (((\<lambda>a. case a of Inl f \<Rightarrow> liftE (when isBlocking (handleFault rv f)) | Inr a \<Rightarrow> case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs rv buffer rva;
a <- global.decodeInvocation (msgLabel rva) args rvb slot cap extracaps >>= invocationCatch rv isBlocking isCall id;
case a of Inl a \<Rightarrow> case a of Inl syserr \<Rightarrow> liftE (when isCall (replyFromKernel rv (msgFromSyscallError syserr))) | Inr a \<Rightarrow> throwError a | Inr x \<Rightarrow> liftE (replyOnRestart rv [] isCall)
od) \<circ> Inl) err) (IF lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>length___unsigned_long,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',isBlockinga,isCalla,\<acute>buffer);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 6. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 7. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 8. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) (?Q''5542 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err') [SKIP] (when isBlocking (handleFault rv err) >>= returnOk) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false);;
IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 6. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 7. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 8. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5542 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) (?Q''5542 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err') [SKIP] (when isBlocking (handleFault rv err) >>= returnOk) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false);;
(IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>?QE5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5542 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s))}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 6. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 7. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 8. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'10717 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err') [SKIP] (when isBlocking (handleFault rv err) >>= returnOk) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false);;
(IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ?P'10717 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q10715 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s)})}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 6. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 7. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 8. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'10717 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) (?Q'10719 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [SKIP] (when isBlocking (handleFault rv err) >>= returnOk) (IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
(return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) (?Q'10719 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err')
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; ?P'10717 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s'. (s, s') \<in> rf_sr}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ?P'10717 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q10715 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s)})}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 8. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 9. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 10. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P10730 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) (?Q'10719 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [] (when isBlocking (handleFault rv err)) (IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI)
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; dc rvc rv'a\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc) (?Q'10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a) [SKIP] (returnOk rvc) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<lbrace>?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err\<rbrace> when isBlocking (handleFault rv err) \<lbrace>?Q10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err')
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) (?Q'10719 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err')
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; (?P10730 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err and ?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s'. (s, s') \<in> rf_sr}
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and (?P10730 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a and ?R10728 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a)\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q10715 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s)})}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (14 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> isBlocking = (s' \<in> \<lbrace>isBlocking\<rbrace>)
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt10738 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) (?Rt10736 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [] (handleFault rv err) (CALL handleFault_'proc(thread))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; dc rvc rv'a\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc) (?Q'10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a) [SKIP] (returnOk rvc) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<lbrace>?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err\<rbrace> when isBlocking (handleFault rv err) \<lbrace>?Q10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err')
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s. (s \<in> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> ?Rt10736 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') \<and> (s \<notin> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> UNIV)}
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> ?Pt10738 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and ?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s'. (s, s') \<in> rf_sr}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> ?Pt10738 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and ?R10728 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a)\<rbrace>
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q10715 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s)})}
 10. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt10738 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) (?Rt10736 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') [] (handleFault rv err) (CALL handleFault_'proc(thread))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; dc rvc rv'a\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc) (?Q'10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a) [SKIP] (returnOk rvc) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<lbrace>?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err\<rbrace> when isBlocking (handleFault rv err) \<lbrace>?Q10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err')
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s. (s \<in> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> ?Rt10736 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err') \<and> (s \<notin> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> UNIV)}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> ?Pt10738 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and ?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s'. (s, s') \<in> rf_sr}
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> ?Pt10738 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and ?R10728 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a)\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q10715 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s)})}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; dc rvc rv'a\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc) (?Q'10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a) [SKIP] (returnOk rvc) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>buffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,thread);;
(\<acute>status :== CALL lookupExtraCaps_'proc(thread,\<acute>buffer,info);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  IF isBlocking THEN
  CALL handleFault_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(info);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(IF SCAST(32 signed \<rightarrow> 32) n_msgRegisters < \<acute>length___unsigned_long \<and> \<acute>buffer = NULL THEN
  \<acute>length___unsigned_long :== SCAST(32 signed \<rightarrow> 32) n_msgRegisters
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(info);;
(\<acute>status :== CALL decodeInvocation_'proc(\<acute>ret__unsigned,cptr,lookupCapAndSlot_ret_C.slot_C rv',lookupCapAndSlot_ret_C.cap_C rv',from_bool isBlocking,from_bool isCall);;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_PREEMPTED THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(IF \<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR THEN
  IF isCall THEN
  CALL replyFromKernel_error_'proc(thread)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>ret__unsigned :== CALL thread_state_get_tsType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(thread\<rightarrow>[''tcbState_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart THEN
  IF isCall THEN
  CALL replyFromKernel_success_empty_'proc(thread)
FI;;
CALL setThreadState_'proc(thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<lbrace>?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err\<rbrace> when isBlocking (handleFault rv err) \<lbrace>?Q10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err')
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s. (s \<in> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>}) \<and> (s \<notin> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> UNIV)}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and ?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s'. (s, s') \<in> rf_sr}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and ?R10728 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a)\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q10715 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s)})}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 10. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (13 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; dc rvc rv'a\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc) (?P'10751 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a) [SKIP] (returnOk rvc) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; dc rvc rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10751 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a) return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},UNIV
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<lbrace>?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err\<rbrace> when isBlocking (handleFault rv err) \<lbrace>?Q10725 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'a. ?P'10751 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a \<inter> ?R'10751 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a)
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s. (s \<in> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>}) \<and> (s \<notin> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> UNIV)}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and ?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s'. (s, s') \<in> rf_sr}
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and ?R10728 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a)\<rbrace>
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q10715 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s)})}
 9. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 10. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (12 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; dc rvc rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10751 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a) return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},UNIV
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<lbrace>?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err\<rbrace> when isBlocking (handleFault rv err) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'a. \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvc (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> ?R'10751 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' rvc rv'a)
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s. (s \<in> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>}) \<and> (s \<notin> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> UNIV)}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and ?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s'. (s, s') \<in> rf_sr}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and ?R10728 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a)\<rbrace>
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q10715 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s)})}
 8. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 9. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 10. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (11 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<lbrace>?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err\<rbrace> when isBlocking (handleFault rv err) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'a. \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvc (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>)
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s. (s \<in> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>}) \<and> (s \<notin> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> UNIV)}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and ?R10728 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s'. (s, s') \<in> rf_sr}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and ?R10728 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr a)\<rbrace>
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q10715 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s)})}
 7. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 8. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 9. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 10. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (10 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'a. \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rvc (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>)
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s. (s \<in> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>}) \<and> (s \<notin> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> UNIV)}
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s'. (s, s') \<in> rf_sr}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and (\<lambda>a. True))\<rbrace>
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q10715 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s)})}
 6. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 7. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 8. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 9. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 10. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (9 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err') \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s. (s \<in> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. thread) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some err) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr rv\<rbrace>}) \<and> (s \<notin> \<lbrace>isBlocking\<rbrace> \<longrightarrow> s \<in> UNIV)}
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q10715 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr cptr err rv' err' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s'. (s, s') \<in> rf_sr}
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and (\<lambda>a. True))\<rbrace>
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> ?Q10715 isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr ft (lu_ret_' s) (errstate s)})}
 5. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 6. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 7. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 8. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 9. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = cptr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some err) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(cptr,SCAST(32 signed \<rightarrow> 32) false) {s'. (s, s') \<in> rf_sr}
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and (\<lambda>a. True))\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = cptr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>})}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 6. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 7. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 8. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr err rv' err' s. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr; lookupCapAndSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C rv') err'; ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = cptr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some err) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = cptr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (s, globals_update (current_fault_'_update (\<lambda>_. ret__struct_seL4_Fault_C_' t)) sa) \<in> rf_sr}
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and (\<lambda>a. True))\<rbrace>
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = cptr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>})}
 4. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 5. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 6. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 7. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 8. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (7 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<lbrace>?R5551 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long info cptr\<rbrace> capFaultOnFailure cptr False (lookupCapAndSlot rv cptr) \<lbrace>\<lambda>a. tcb_at' rv and (\<lambda>b. valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> True \<and> msgLength rva \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> valid_cap' (fst a) b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> real_cte_at' (snd a) b \<and> (\<forall>r\<in>zobj_refs' (fst a). ex_nonz_cap_to' r b) \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>b. fst a = cteCap b) (snd a) b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>r\<in>cte_refs' (fst a) (irq_node' b). ex_cte_cap_wp_to' (\<lambda>_. True) r b) \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv b)\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>s. isBlocking \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p))) s) and (\<lambda>s. \<not> isBlocking \<longrightarrow> True) and (\<lambda>a. True))\<rbrace>
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = cptr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>})}
 3. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and ?R5551 isBlockinga isCalla rv thread rva ret__unsigned_long info a\<rbrace>
 4. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 5. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 6. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 7. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (6 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info rvb cptr. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long); rvb = cptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv thread ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(thread,cptr) {s. (\<forall>rv'. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (case rv' of (c, s) \<Rightarrow> \<lambda>a. case a of (c', s') \<Rightarrow> ccap_relation c c' \<and> s' = cte_Ptr s) (lookupCapAndSlot_ret_C.cap_C (lu_ret_' s), lookupCapAndSlot_ret_C.slot_C (lu_ret_' s)) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. thread) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rvb. ((=) \<circ> option_to_ptr) rvb (ret__ptr_to_unsigned_long_' t) \<longrightarrow> buffer_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. info_'_update (\<lambda>_. info) (bufferPtr_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (thread_'_update (\<lambda>_. thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr rvb\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rva\<rbrace>}}) \<and> (\<forall>ft. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> \<lbrace>\<forall>t. seL4_Fault_CapFault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>seL4_Fault_CapFault_CL.address_CL = cptr && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>})}
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and (\<lambda>a. (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' rv a \<and> sch_act_not rv a \<and> (\<forall>aa b. rv \<notin> set (ksReadyQueues a (aa, b)))) \<and> tcb_at' rv a \<and> valid_pspace' a \<and> tcb_at' rv a \<and> valid_objs' a \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' rv a \<and> sch_act_not rv a \<and> (\<forall>aa b. rv \<notin> set (ksReadyQueues a (aa, b)))) \<and> msgLength rva \<le> 0x78 \<and> invs' a \<and> sch_act_simple a \<and> ex_nonz_cap_to' rv a \<and> vs_valid_duplicates' (ksPSpace a) \<and> rv = ksCurThread a \<and> ksCurThread a = rv \<and> invs' a \<and> rv \<noteq> ksIdleThread a \<and> tcb_at' rv a \<and> valid_objs' a \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ct_active' a \<and> True \<and> valid_objs' a \<and> invs' a \<and> invs' a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b))) \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> rv = ksCurThread a \<and> cur_tcb' a \<and> valid_objs' a \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv a)\<rbrace>
 3. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 4. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 5. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 6. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (6 subgoals):
 1. \<And>rv ret__unsigned_long info cptr. seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5543 rv (tcb_ptr_to_ctcb_ptr rv) ret__unsigned_long info cptr cptr) \<acute>lu_ret :== CALL lookupCapAndSlot_'proc(tcb_ptr_to_ctcb_ptr rv,cptr) {s. lookupCapAndSlot_ret_C.status_C (lu_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault cptr False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (lu_ret_' s)) (errstate s)) \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = cptr, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (current_lookup_fault_' (globals s)))))}
 2. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and (\<lambda>a. (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' rv a \<and> sch_act_not rv a \<and> (\<forall>aa b. rv \<notin> set (ksReadyQueues a (aa, b)))) \<and> tcb_at' rv a \<and> valid_pspace' a \<and> tcb_at' rv a \<and> valid_objs' a \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' rv a \<and> sch_act_not rv a \<and> (\<forall>aa b. rv \<notin> set (ksReadyQueues a (aa, b)))) \<and> msgLength rva \<le> 0x78 \<and> invs' a \<and> sch_act_simple a \<and> ex_nonz_cap_to' rv a \<and> vs_valid_duplicates' (ksPSpace a) \<and> rv = ksCurThread a \<and> ksCurThread a = rv \<and> invs' a \<and> rv \<noteq> ksIdleThread a \<and> tcb_at' rv a \<and> valid_objs' a \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ct_active' a \<and> True \<and> valid_objs' a \<and> invs' a \<and> invs' a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b))) \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> rv = ksCurThread a \<and> cur_tcb' a \<and> valid_objs' a \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv a)\<rbrace>
 3. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 4. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 5. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>ta rvb. rvb = ret__unsigned_long_' ta \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' ta) (s'\<lparr>globals := globals ta\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' ta) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>ta\<^esup>ret__unsigned_long\<rbrace>} \<inter> ?R'5547 isBlockinga isCalla rv (thread_' s) rva (ret__unsigned_long_' t) v ta rvb}}}
 6. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>rv thread ret__unsigned_long. ?R'5547 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long) ret__unsigned_long \<equiv>\<^sup>? \<lambda>rv thread ret__unsigned_long info t rva. ?R'5543 rv thread ret__unsigned_long info rva (ret__unsigned_long_' t) proof (prove)
goal (5 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> tcb_at' rv a) and (\<lambda>a. (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' rv a \<and> sch_act_not rv a \<and> (\<forall>aa b. rv \<notin> set (ksReadyQueues a (aa, b)))) \<and> tcb_at' rv a \<and> valid_pspace' a \<and> tcb_at' rv a \<and> valid_objs' a \<and> unat (msgExtraCaps rva) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' rv a \<and> sch_act_not rv a \<and> (\<forall>aa b. rv \<notin> set (ksReadyQueues a (aa, b)))) \<and> msgLength rva \<le> 0x78 \<and> invs' a \<and> sch_act_simple a \<and> ex_nonz_cap_to' rv a \<and> vs_valid_duplicates' (ksPSpace a) \<and> rv = ksCurThread a \<and> ksCurThread a = rv \<and> invs' a \<and> rv \<noteq> ksIdleThread a \<and> tcb_at' rv a \<and> valid_objs' a \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ct_active' a \<and> True \<and> valid_objs' a \<and> invs' a \<and> invs' a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b))) \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> rv = ksCurThread a \<and> cur_tcb' a \<and> valid_objs' a \<and> msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv a)\<rbrace>
 2. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 3. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 4. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = ret__unsigned_long_' t \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s. \<forall>ta. lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (ret__unsigned_long_' t) False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' ta)) (errstate (lu_ret_'_update (\<lambda>_. ret__struct_lookupCapAndSlot_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>)))) \<longrightarrow> (\<exists>sa. (sa, lu_ret_'_update (\<lambda>_. ret__struct_lookupCapAndSlot_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>)) \<in> rf_sr) \<longrightarrow> (\<forall>tb. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = ret__unsigned_long_' t, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (current_lookup_fault_' (globals ta)))))}}}}
 5. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>isBlockinga isCalla rv thread rva ret__unsigned_long info. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; tcb_ptr_to_ctcb_ptr rv = thread; rva = messageInfoFromWord ret__unsigned_long; seL4_MessageInfo_lift info = mi_from_H (messageInfoFromWord ret__unsigned_long)\<rbrakk> \<Longrightarrow> \<lbrace>?R4705 (from_bool isBlocking) (from_bool isCall) rv thread (messageInfoFromWord ret__unsigned_long)\<rbrace> asUser rv (getRegister Thread_H.capRegister) \<lbrace>\<lambda>a b. invs' b \<and> tcb_at' rv b \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> tcb_at' rv b \<and> valid_pspace' b \<and> tcb_at' rv b \<and> valid_objs' b \<and> unat (msgExtraCaps (messageInfoFromWord ret__unsigned_long)) \<le> 3 \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' rv b \<and> sch_act_not rv b \<and> (\<forall>a ba. rv \<notin> set (ksReadyQueues b (a, ba)))) \<and> msgLength (messageInfoFromWord ret__unsigned_long) \<le> 0x78 \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' rv b \<and> vs_valid_duplicates' (ksPSpace b) \<and> rv = ksCurThread b \<and> ksCurThread b = rv \<and> invs' b \<and> rv \<noteq> ksIdleThread b \<and> tcb_at' rv b \<and> valid_objs' b \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> rv = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> msgLength (messageInfoFromWord ret__unsigned_long) \<le> msgMaxLength \<and> st_tcb_at' simple' rv b\<rbrace>
 2. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?R3313 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4705 isBlockinga isCalla rv thread a\<rbrace>
 3. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3313 isBlockinga isCalla a\<rbrace>
 4. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = ret__unsigned_long_' t \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s. \<forall>ta. lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (ret__unsigned_long_' t) False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' ta)) (errstate (lu_ret_'_update (\<lambda>_. ret__struct_lookupCapAndSlot_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>)))) \<longrightarrow> (\<exists>sa. (sa, lu_ret_'_update (\<lambda>_. ret__struct_lookupCapAndSlot_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>)) \<in> rf_sr) \<longrightarrow> (\<forall>tb. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = ret__unsigned_long_' t, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (current_lookup_fault_' (globals ta)))))}}}}
 5. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>isBlockinga isCalla rv thread. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv thread\<rbrakk> \<Longrightarrow> \<lbrace>?P'11209 isBlockinga isCalla rv\<rbrace> getMessageInfo rv \<lbrace>\<lambda>rva s. msgLength rva \<le> msgMaxLength \<and> st_tcb_at' simple' rv s\<rbrace>
 2. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. True \<and> (invs' and tcb_at' a) s \<and> tcb_at' a s \<and> (isBlocking \<longrightarrow> invs' s \<and> st_tcb_at' simple' a s \<and> sch_act_not a s \<and> (\<forall>aa b. a \<notin> set (ksReadyQueues s (aa, b)))) \<and> tcb_at' a s \<and> valid_pspace' s \<and> tcb_at' a s \<and> valid_objs' s \<and> True \<and> (isBlocking \<longrightarrow> invs' s \<and> st_tcb_at' simple' a s \<and> sch_act_not a s \<and> (\<forall>aa b. a \<notin> set (ksReadyQueues s (aa, b)))) \<and> True \<and> invs' s \<and> sch_act_simple s \<and> ex_nonz_cap_to' a s \<and> vs_valid_duplicates' (ksPSpace s) \<and> a = ksCurThread s \<and> ksCurThread s = a \<and> invs' s \<and> a \<noteq> ksIdleThread s \<and> tcb_at' a s \<and> valid_objs' s \<and> invs' s \<and> valid_objs' s \<and> invs' s \<and> ct_active' s \<and> valid_objs' s \<and> invs' s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> invs' s \<and> valid_objs' s \<and> invs' s \<and> a = ksCurThread s \<and> cur_tcb' s \<and> valid_objs' s \<and> ?P'11209 isBlockinga isCalla a s)\<rbrace>
 3. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = ret__unsigned_long_' t \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s. \<forall>ta. lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (ret__unsigned_long_' t) False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' ta)) (errstate (lu_ret_'_update (\<lambda>_. ret__struct_lookupCapAndSlot_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>)))) \<longrightarrow> (\<exists>sa. (sa, lu_ret_'_update (\<lambda>_. ret__struct_lookupCapAndSlot_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>)) \<in> rf_sr) \<longrightarrow> (\<forall>tb. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = ret__unsigned_long_' t, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (current_lookup_fault_' (globals ta)))))}}}}
 4. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. True \<and> (invs' and tcb_at' a) s \<and> tcb_at' a s \<and> (isBlocking \<longrightarrow> invs' s \<and> st_tcb_at' simple' a s \<and> sch_act_not a s \<and> (\<forall>aa b. a \<notin> set (ksReadyQueues s (aa, b)))) \<and> tcb_at' a s \<and> valid_pspace' s \<and> tcb_at' a s \<and> valid_objs' s \<and> True \<and> (isBlocking \<longrightarrow> invs' s \<and> st_tcb_at' simple' a s \<and> sch_act_not a s \<and> (\<forall>aa b. a \<notin> set (ksReadyQueues s (aa, b)))) \<and> True \<and> invs' s \<and> sch_act_simple s \<and> ex_nonz_cap_to' a s \<and> vs_valid_duplicates' (ksPSpace s) \<and> a = ksCurThread s \<and> ksCurThread s = a \<and> invs' s \<and> a \<noteq> ksIdleThread s \<and> tcb_at' a s \<and> valid_objs' s \<and> invs' s \<and> valid_objs' s \<and> invs' s \<and> ct_active' s \<and> valid_objs' s \<and> invs' s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> invs' s \<and> valid_objs' s \<and> invs' s \<and> a = ksCurThread s \<and> cur_tcb' s \<and> valid_objs' s \<and> True \<and> st_tcb_at' simple' a s)\<rbrace>
 2. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = ret__unsigned_long_' t \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s. \<forall>ta. lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (ret__unsigned_long_' t) False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' ta)) (errstate (lu_ret_'_update (\<lambda>_. ret__struct_lookupCapAndSlot_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>)))) \<longrightarrow> (\<exists>sa. (sa, lu_ret_'_update (\<lambda>_. ret__struct_lookupCapAndSlot_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>)) \<in> rf_sr) \<longrightarrow> (\<forall>tb. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = ret__unsigned_long_' t, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (current_lookup_fault_' (globals ta)))))}}}}
 3. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>isBlockinga isCalla. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R2581 (from_bool isBlocking) (from_bool isCall)\<rbrace> getCurThread \<lbrace>\<lambda>a b. invs' b \<and> tcb_at' a b \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' a b \<and> sch_act_not a b \<and> (\<forall>aa ba. a \<notin> set (ksReadyQueues b (aa, ba)))) \<and> tcb_at' a b \<and> valid_pspace' b \<and> tcb_at' a b \<and> valid_objs' b \<and> (isBlocking \<longrightarrow> invs' b \<and> st_tcb_at' simple' a b \<and> sch_act_not a b \<and> (\<forall>aa ba. a \<notin> set (ksReadyQueues b (aa, ba)))) \<and> invs' b \<and> sch_act_simple b \<and> ex_nonz_cap_to' a b \<and> vs_valid_duplicates' (ksPSpace b) \<and> a = ksCurThread b \<and> ksCurThread b = a \<and> invs' b \<and> a \<noteq> ksIdleThread b \<and> tcb_at' a b \<and> valid_objs' b \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> ct_active' b \<and> valid_objs' b \<and> invs' b \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba))) \<and> invs' b \<and> valid_objs' b \<and> invs' b \<and> a = ksCurThread b \<and> cur_tcb' b \<and> valid_objs' b \<and> st_tcb_at' simple' a b\<rbrace>
 2. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = ret__unsigned_long_' t \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s. \<forall>ta. lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (ret__unsigned_long_' t) False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' ta)) (errstate (lu_ret_'_update (\<lambda>_. ret__struct_lookupCapAndSlot_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>)))) \<longrightarrow> (\<exists>sa. (sa, lu_ret_'_update (\<lambda>_. ret__struct_lookupCapAndSlot_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>)) \<in> rf_sr) \<longrightarrow> (\<forall>tb. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = ret__unsigned_long_' t, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (current_lookup_fault_' (globals ta)))))}}}}
 3. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2581 isBlockinga isCalla) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>isBlockinga isCalla s rv. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; ((=) \<circ> tcb_ptr_to_ctcb_ptr) rv (thread_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H TCB_H.msgInfoRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = messageInfoFromWord (ret__unsigned_long_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (w_' (w_'_update (\<lambda>_. ret__unsigned_long_' t) sa))) \<longrightarrow> info_'_update (\<lambda>_. v) sa \<in> {sa. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Thread_H.capRegister\<rbrace>} \<inter> {s'. \<forall>t rva. rva = ret__unsigned_long_' t \<longrightarrow> cptr_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sa. cPtr_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. thread_' s) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>cPtr = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s. \<forall>ta. lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (ret__unsigned_long_' t) False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' ta)) (errstate (lu_ret_'_update (\<lambda>_. ret__struct_lookupCapAndSlot_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>)))) \<longrightarrow> (\<exists>sa. (sa, lu_ret_'_update (\<lambda>_. ret__struct_lookupCapAndSlot_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>)) \<in> rf_sr) \<longrightarrow> (\<forall>tb. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tb) = \<lparr>seL4_Fault_CapFault_CL.address_CL = ret__unsigned_long_' t, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tb) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' tb)) (lookup_fault_lift (current_lookup_fault_' (globals ta)))))}}}}
 2. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. invs' a \<and> tcb_at' (ksCurThread a) a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> tcb_at' (ksCurThread a) a \<and> valid_pspace' a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> invs' a \<and> sch_act_simple a \<and> ex_nonz_cap_to' (ksCurThread a) a \<and> vs_valid_duplicates' (ksPSpace a) \<and> ksCurThread a = ksCurThread a \<and> ksCurThread a = ksCurThread a \<and> invs' a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ct_active' a \<and> valid_objs' a \<and> invs' a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b))) \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ksCurThread a = ksCurThread a \<and> cur_tcb' a \<and> valid_objs' a \<and> st_tcb_at' simple' (ksCurThread a) a)) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>s rv. tcb_ptr_to_ctcb_ptr rv = thread_' s \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister = register_from_H TCB_H.msgInfoRegister \<and> (\<forall>t v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (ret__unsigned_long_' t)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister = register_from_H Thread_H.capRegister \<and> (\<forall>ta tb. lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' tb) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (ret__unsigned_long_' ta) False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' tb)) (errstate (s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, info_' := v, cptr_' := ret__unsigned_long_' ta, globals := globals ta\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals tb), ghost'state_' := ghost'state_' (globals tb)\<rparr>\<rparr>))) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, info_' := v, cptr_' := ret__unsigned_long_' ta, globals := globals ta\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals tb), ghost'state_' := ghost'state_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = ret__unsigned_long_' ta, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (current_lookup_fault_' (globals tb)))))))
 2. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. invs' a \<and> tcb_at' (ksCurThread a) a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> tcb_at' (ksCurThread a) a \<and> valid_pspace' a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> invs' a \<and> sch_act_simple a \<and> ex_nonz_cap_to' (ksCurThread a) a \<and> vs_valid_duplicates' (ksPSpace a) \<and> ksCurThread a = ksCurThread a \<and> ksCurThread a = ksCurThread a \<and> invs' a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ct_active' a \<and> valid_objs' a \<and> invs' a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b))) \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ksCurThread a = ksCurThread a \<and> cur_tcb' a \<and> valid_objs' a \<and> st_tcb_at' simple' (ksCurThread a) a)) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>s rv. tcb_ptr_to_ctcb_ptr rv = thread_' s \<Longrightarrow> \<forall>t v. seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (ret__unsigned_long_' t)) \<longrightarrow> (\<forall>ta tb. lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' tb) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. (\<exists>w. ft = Fault_H.fault.CapFault (ret__unsigned_long_' ta) False w \<and> lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' tb)) (errstate (s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, info_' := v, cptr_' := ret__unsigned_long_' ta, globals := globals ta\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals tb), ghost'state_' := ghost'state_' (globals tb)\<rparr>\<rparr>))) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, info_' := v, cptr_' := ret__unsigned_long_' ta, globals := globals ta\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals tb), ghost'state_' := ghost'state_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr) \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = ret__unsigned_long_' ta, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> isBlocking \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (current_lookup_fault_' (globals tb))))))
 2. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. invs' a \<and> tcb_at' (ksCurThread a) a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> tcb_at' (ksCurThread a) a \<and> valid_pspace' a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> invs' a \<and> sch_act_simple a \<and> ex_nonz_cap_to' (ksCurThread a) a \<and> vs_valid_duplicates' (ksPSpace a) \<and> ksCurThread a = ksCurThread a \<and> ksCurThread a = ksCurThread a \<and> invs' a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ct_active' a \<and> valid_objs' a \<and> invs' a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b))) \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ksCurThread a = ksCurThread a \<and> cur_tcb' a \<and> valid_objs' a \<and> st_tcb_at' simple' (ksCurThread a) a)) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>s rv t v ta tb w sa tc. \<lbrakk>tcb_ptr_to_ctcb_ptr rv = thread_' s; seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (ret__unsigned_long_' t)); lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' tb) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' tb)) (errstate (s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, info_' := v, cptr_' := ret__unsigned_long_' ta, globals := globals ta\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals tb), ghost'state_' := ghost'state_' (globals tb)\<rparr>\<rparr>)); (sa, s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, info_' := v, cptr_' := ret__unsigned_long_' ta, globals := globals ta\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals tb), ghost'state_' := ghost'state_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tc) = \<lparr>seL4_Fault_CapFault_CL.address_CL = ret__unsigned_long_' ta, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' tc) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault; isBlocking\<rbrakk> \<Longrightarrow> \<exists>cf'. seL4_Fault_lift (ret__struct_seL4_Fault_C_' tc) = Some cf' \<and> (if is_cap_fault cf' then \<exists>lf'. lookup_fault_lift (current_lookup_fault_' (globals tb)) = Some lf' \<and> fault_to_H cf' lf' = Some (Fault_H.fault.CapFault (ret__unsigned_long_' ta) False w) else fault_to_H cf' undefined = Some (Fault_H.fault.CapFault (ret__unsigned_long_' ta) False w))
 2. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. invs' a \<and> tcb_at' (ksCurThread a) a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> tcb_at' (ksCurThread a) a \<and> valid_pspace' a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> invs' a \<and> sch_act_simple a \<and> ex_nonz_cap_to' (ksCurThread a) a \<and> vs_valid_duplicates' (ksPSpace a) \<and> ksCurThread a = ksCurThread a \<and> ksCurThread a = ksCurThread a \<and> invs' a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ct_active' a \<and> valid_objs' a \<and> invs' a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b))) \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ksCurThread a = ksCurThread a \<and> cur_tcb' a \<and> valid_objs' a \<and> st_tcb_at' simple' (ksCurThread a) a)) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>s rv t v ta tb w sa tc. \<lbrakk>tcb_ptr_to_ctcb_ptr rv = thread_' s; seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (ret__unsigned_long_' t)); lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' tb) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' tb)) (errstate (s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, info_' := v, cptr_' := ret__unsigned_long_' ta, globals := globals ta\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals tb), ghost'state_' := ghost'state_' (globals tb)\<rparr>\<rparr>)); (sa, s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, info_' := v, cptr_' := ret__unsigned_long_' ta, globals := globals ta\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals tb), ghost'state_' := ghost'state_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tc) = \<lparr>seL4_Fault_CapFault_CL.address_CL = ret__unsigned_long_' ta, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_lift (ret__struct_seL4_Fault_C_' tc) = Some (SeL4_Fault_CapFault \<lparr>seL4_Fault_CapFault_CL.address_CL = ret__unsigned_long_' ta, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>); isBlocking\<rbrakk> \<Longrightarrow> \<exists>lf'. lookup_fault_lift (current_lookup_fault_' (globals tb)) = Some lf' \<and> lookup_fault_to_H lf' = w
 2. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. invs' a \<and> tcb_at' (ksCurThread a) a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> tcb_at' (ksCurThread a) a \<and> valid_pspace' a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> invs' a \<and> sch_act_simple a \<and> ex_nonz_cap_to' (ksCurThread a) a \<and> vs_valid_duplicates' (ksPSpace a) \<and> ksCurThread a = ksCurThread a \<and> ksCurThread a = ksCurThread a \<and> invs' a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ct_active' a \<and> valid_objs' a \<and> invs' a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b))) \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ksCurThread a = ksCurThread a \<and> cur_tcb' a \<and> valid_objs' a \<and> st_tcb_at' simple' (ksCurThread a) a)) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>s rv t v ta tb w sa tc. \<lbrakk>tcb_ptr_to_ctcb_ptr rv = thread_' s; seL4_MessageInfo_lift v = mi_from_H (messageInfoFromWord (ret__unsigned_long_' t)); lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' tb) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCapAndSlot_ret_C.status_C (ret__struct_lookupCapAndSlot_ret_C_' tb)) (errstate (s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, info_' := v, cptr_' := ret__unsigned_long_' ta, globals := globals ta\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals tb), ghost'state_' := ghost'state_' (globals tb)\<rparr>\<rparr>)); (sa, s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, info_' := v, cptr_' := ret__unsigned_long_' ta, globals := globals ta\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals tb), ghost'state_' := ghost'state_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' tc) = \<lparr>seL4_Fault_CapFault_CL.address_CL = ret__unsigned_long_' ta, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_lift (ret__struct_seL4_Fault_C_' tc) = Some (SeL4_Fault_CapFault \<lparr>seL4_Fault_CapFault_CL.address_CL = ret__unsigned_long_' ta, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>); isBlocking; \<exists>va. lookup_fault_lift (current_lookup_fault_' (globals (s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, info_' := v, cptr_' := ret__unsigned_long_' ta, globals := globals ta\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals tb), ghost'state_' := ghost'state_' (globals tb)\<rparr>\<rparr>))) = Some va \<and> lookup_fault_to_H va = w\<rbrakk> \<Longrightarrow> \<exists>lf'. lookup_fault_lift (current_lookup_fault_' (globals tb)) = Some lf' \<and> lookup_fault_to_H lf' = w
 2. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. invs' a \<and> tcb_at' (ksCurThread a) a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> tcb_at' (ksCurThread a) a \<and> valid_pspace' a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> invs' a \<and> sch_act_simple a \<and> ex_nonz_cap_to' (ksCurThread a) a \<and> vs_valid_duplicates' (ksPSpace a) \<and> ksCurThread a = ksCurThread a \<and> ksCurThread a = ksCurThread a \<and> invs' a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ct_active' a \<and> valid_objs' a \<and> invs' a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b))) \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ksCurThread a = ksCurThread a \<and> cur_tcb' a \<and> valid_objs' a \<and> st_tcb_at' simple' (ksCurThread a) a)) s \<and> s' \<in> UNIV proof (prove)
goal (1 subgoal):
 1. \<And>isBlockinga isCalla s s'. \<lbrakk>isBlockinga = from_bool isBlocking; isCalla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. invs' a \<and> tcb_at' (ksCurThread a) a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> tcb_at' (ksCurThread a) a \<and> valid_pspace' a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> (isBlocking \<longrightarrow> invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_not (ksCurThread a) a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b)))) \<and> invs' a \<and> sch_act_simple a \<and> ex_nonz_cap_to' (ksCurThread a) a \<and> vs_valid_duplicates' (ksPSpace a) \<and> ksCurThread a = ksCurThread a \<and> ksCurThread a = ksCurThread a \<and> invs' a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> tcb_at' (ksCurThread a) a \<and> valid_objs' a \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ct_active' a \<and> valid_objs' a \<and> invs' a \<and> (\<forall>aa b. ksCurThread a \<notin> set (ksReadyQueues a (aa, b))) \<and> invs' a \<and> valid_objs' a \<and> invs' a \<and> ksCurThread a = ksCurThread a \<and> cur_tcb' a \<and> valid_objs' a \<and> st_tcb_at' simple' (ksCurThread a) a)) s \<and> s' \<in> UNIV proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; vs_valid_duplicates' (ksPSpace s); st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> (isBlocking \<longrightarrow> st_tcb_at' simple' (ksCurThread s) s) \<and> valid_pspace' s \<and> valid_objs' s \<and> (isBlocking \<longrightarrow> st_tcb_at' simple' (ksCurThread s) s) \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> valid_objs' s \<and> cur_tcb' s \<and> valid_objs' s \<and> st_tcb_at' simple' (ksCurThread s) s proof (prove)
goal:
No subgoals!