theory Ipc_C

lemma setMRs_fault_ccorres [corres]:
  "ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_'
           (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender
                          and tcb_at' receiver
                          and (case buffer of Some x \<Rightarrow> valid_ipc_buffer_ptr' x | None \<Rightarrow> \<top>)
                          and K (buffer \<noteq> Some 0)
                          and K (sender \<noteq> receiver))
           (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace>
                 \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>
                 \<inter> \<lbrace>\<acute>receiveIPCBuffer = Ptr (option_to_0 buffer)\<rbrace>) hs
    (makeFaultMessage ft sender >>= (\<lambda>ms. setMRs receiver buffer (snd ms)))
    (Call setMRs_fault_'proc)" proof - let ?obj_at_ft = "obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender" note symb_exec_r_fault = ccorres_symb_exec_r_known_rv_UNIV
          [where xf'=ret__unsigned_' and R="?obj_at_ft" and R'=UNIV] note empty_fail_cond[simp] show ?thesis apply (unfold K_def) apply (intro ccorres_gen_asm) apply (cinit' lift: sender_' receiver_' receiveIPCBuffer_' simp: whileAnno_def) apply (simp add: makeFaultMessage_def setMRs_to_setMR
                 del: Collect_const split del: if_split) apply (rule_tac val="fault_to_fault_tag ft" in symb_exec_r_fault) apply (vcg, clarsimp) apply (drule(1) obj_at_cslift_tcb) apply (clarsimp simp: ctcb_relation_def typ_heap_simps'
                              cfault_rel_def seL4_Fault_lift_def Let_def
                       split: if_split_asm) apply ceqv 
      (* UserException *)
       apply wpc apply (simp add: bind_assoc seL4_Fault_tag_defs ccorres_cond_iffs
                          Collect_True Collect_False
                          zipWithM_mapM zip_append2 mapM_append
                     del: Collect_const split del: if_split) apply (rule ccorres_symb_exec_l) apply (rule ccorres_stateAssert) apply (rule_tac P="length msg = unat n_exceptionMessage"
                       in ccorres_gen_asm) apply (simp add: n_exceptionMessage_def msgMaxLength_unfold
                             zip_upt_Cons mapM_Nil mapM_Cons bind_assoc
                             mapM_discarded
                        del: Collect_const upt.simps upt_rec_numeral
                        split del: if_split) apply (rule ccorres_rhs_assoc)+ apply (ctac add: copyMRsFault_ccorres_exception) apply (rule ccorres_move_c_guard_tcb) apply (rule_tac val="userExceptionNumber ft" in symb_exec_r_fault) apply (vcg, clarsimp) apply (drule(1) obj_at_cslift_tcb) apply (clarsimp simp: ctcb_relation_def typ_heap_simps
                                       cfault_rel_def seL4_Fault_lift_def
                                       seL4_Fault_UserException_lift_def Let_def
                                split: if_split_asm) apply ceqv apply (ctac add: setMR_ccorres_dc) apply (rule ccorres_move_c_guard_tcb) apply (rule_tac val="userExceptionErrorCode ft" in symb_exec_r_fault) apply (vcg, clarsimp) apply (drule(1) obj_at_cslift_tcb) apply (clarsimp simp: ctcb_relation_def typ_heap_simps
                                          cfault_rel_def seL4_Fault_lift_def
                                          seL4_Fault_UserException_lift_def Let_def
                                   split: if_split_asm) apply ceqv apply (ctac add: setMR_ccorres) apply (rule ccorres_return_C, simp+)[1] apply wp apply (simp del: Collect_const) apply (vcg exspec=setMR_modifies) apply (clarsimp simp: option_to_ptr_def guard_is_UNIVI) apply (wp setMR_tcbFault_obj_at
                          hoare_case_option_wp) apply simp apply (vcg exspec=setMR_modifies) apply (clarsimp simp: option_to_ptr_def guard_is_UNIVI) apply (simp add: split_def) apply (wp mapM_x_wp' setMR_tcbFault_obj_at
                       hoare_case_option_wp
                         | simp)+ apply (vcg exspec=copyMRsFault_modifies exspect=setRegister_modifies) apply (wp asUser_inv mapM_wp' getRegister_inv) apply simp apply (wp asUser_inv mapM_wp' getRegister_inv hoare_drop_imps asUser_const_rv
                    asUser_get_registers[simplified atcbContextGet_def comp_def]) apply simp 
         (* CapFault *)
         apply (simp add: Collect_True Collect_False ccorres_cond_iffs
                         zip_upt_Cons msgMaxLength_unfold
                         zipWithM_mapM mapM_Cons bind_assoc
                    del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply (ctac(no_vcg)) apply (rule ccorres_stateAssert) apply (ctac(no_vcg) add: setMR_ccorres_dc) apply (rule_tac val="capFaultAddress ft" in symb_exec_r_fault) apply (rule conseqPre, vcg, clarsimp) apply (drule(1) obj_at_cslift_tcb) apply (clarsimp simp: typ_heap_simps' ctcb_relation_def
                                   cfault_rel_def seL4_Fault_lift_def Let_def
                                   seL4_Fault_CapFault_lift_def
                            split: if_split_asm) apply ceqv apply (ctac(no_vcg) add: setMR_ccorres_dc) apply (rule_tac val="from_bool (capFaultInReceivePhase ft)" in symb_exec_r_fault) apply (rule conseqPre, vcg, clarsimp) apply (drule(1) obj_at_cslift_tcb) apply (clarsimp simp: typ_heap_simps' ctcb_relation_def
                                     cfault_rel_def seL4_Fault_lift_def Let_def
                                     seL4_Fault_CapFault_lift_def
                                     from_bool_to_bool_and_1 word_size
                              split: if_split_asm) apply ceqv apply (ctac(no_vcg) add: setMR_ccorres_dc) apply (rule ccorres_move_c_guard_tcb) apply (rule_tac P="obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender"
                           in ccorres_cross_over_guard) apply (ctac(no_vcg) add: setMRs_lookup_failure_ccorres[unfolded msgMaxLength_unfold]) apply simp apply (rule ccorres_return_C, simp+)[1] apply (wp setMR_tcbFault_obj_at hoare_case_option_wp)+ apply (clarsimp simp: option_to_ptr_def Collect_const_mem guard_is_UNIV_def) apply (rule conjI) apply (simp add: seL4_CapFault_InRecvPhase_def) apply (rule conjI) apply (simp add: from_bool_def split: bool.split) apply clarsimp apply (drule(1) obj_at_cslift_tcb) apply (clarsimp simp: typ_heap_simps' ctcb_relation_def
                                  cfault_rel_def seL4_Fault_lift_def Let_def
                                  seL4_Fault_CapFault_lift_def is_cap_fault_def
                                  seL4_CapFault_LookupFailureType_def
                           split: if_split_asm) apply (wp setMR_tcbFault_obj_at hoare_case_option_wp
                     asUser_inv[OF getRestartPC_inv]
                     | (rule guard_is_UNIVI, clarsimp simp: option_to_ptr_def
                                                            seL4_CapFault_Addr_def))+ 
      (* UnknowSyscall *)
       apply (rename_tac syscall_number) apply (simp add: seL4_Fault_tag_defs Collect_True Collect_False
                       ccorres_cond_iffs zipWithM_mapM mapM_append
                       zip_append2 bind_assoc
                  del: Collect_const) apply (rule ccorres_symb_exec_l) apply (rule ccorres_stateAssert) apply (rule_tac P="length msg = unat n_syscallMessage" in ccorres_gen_asm) apply (simp add: msgMaxLength_unfold n_syscallMessage_def zip_upt_Cons
                          mapM_Cons mapM_Nil mapM_discarded
                     del: Collect_const upt_rec_numeral) apply (rule ccorres_rhs_assoc)+ apply (ctac add: copyMRsFault_ccorres_syscall) apply (rule ccorres_move_c_guard_tcb) apply (rule_tac val="syscall_number" in symb_exec_r_fault) apply (vcg, clarsimp) apply (drule(1) obj_at_cslift_tcb) apply (clarsimp simp: ctcb_relation_def typ_heap_simps'
                                    cfault_rel_def seL4_Fault_lift_def Let_def
                                    seL4_Fault_UnknownSyscall_def
                                    seL4_Fault_UnknownSyscall_lift_def
                              split: if_split_asm) apply ceqv apply (ctac add: setMR_ccorres) apply (rule ccorres_return_C, simp+)[1] apply wp apply (simp del: Collect_const) apply (vcg exspec=setMR_modifies) apply (clarsimp simp: option_to_ptr_def guard_is_UNIVI) apply (wp setMR_tcbFault_obj_at mapM_x_wp_inv hoare_case_option_wp
                | clarsimp
                | wpc)+ apply (vcg exspec=copyMRsFault_modifies) apply (wp asUser_inv mapM_wp' getRegister_inv) apply simp apply (wp asUser_inv mapM_wp' getRegister_inv hoare_drop_imps asUser_const_rv
                 asUser_get_registers[simplified atcbContextGet_def comp_def]) apply simp 
      (* ArchFault *)
       apply (rule ccorres_cond_false) apply (rule ccorres_cond_false) apply (rule ccorres_cond_false) apply (simp add: Collect_True Collect_False ccorres_cond_iffs
                         zip_upt_Cons
                         mapM_Cons bind_assoc
                         seL4_Fault_tag_defs
                    del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_move_c_guard_tcb) apply (rule_tac val="fault_to_fault_tag ft" in symb_exec_r_fault) apply (vcg, clarsimp) apply (drule(1) obj_at_cslift_tcb) apply (clarsimp simp: ctcb_relation_def typ_heap_simps'
                              cfault_rel_def seL4_Fault_lift_def Let_def
                              seL4_Fault_UnknownSyscall_def
                              seL4_Fault_UnknownSyscall_lift_def
                       split: if_split_asm) apply ceqv apply (rule ccorres_add_return2) apply (ctac add: Arch_setMRs_fault_ccorres[simplified setMRs_to_setMR last.simps K_bind_def]) apply (ctac add: ccorres_return_C) apply wpsimp apply (vcg exspec=Arch_setMRs_fault_modifies) apply (clarsimp simp: guard_is_UNIV_def Collect_const_mem) apply (rule  fault_to_fault_tag.simps(2)[symmetric]) 
     (* done *)
      apply (rule guard_is_UNIVI, clarsimp simp: option_to_ptr_def seL4_CapFault_IP_def) apply (case_tac x) apply (simp add: seL4_Faults seL4_Arch_Faults) apply (clarsimp simp: msgMaxLength_unfold length_syscallMessage
                          ARM_H.exceptionMessage_def
                          ARM.exceptionMessage_def
                          n_exceptionMessage_def
                          n_syscallMessage_def) apply (drule(1) obj_at_cslift_tcb[where thread=sender]) apply (clarsimp simp: obj_at'_def projectKOs objBits_simps) apply (clarsimp simp: msgFromLookupFailure_def split: lookup_failure.split) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 buffer)\<rbrace>) hs (do ms <- makeFaultMessage ft sender;
setMRs receiver buffer (snd ms)
od) (Call setMRs_fault_'proc) proof (state)
goal (1 subgoal):
 1. ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 buffer)\<rbrace>) hs (do ms <- makeFaultMessage ft sender;
setMRs receiver buffer (snd ms)
od) (Call setMRs_fault_'proc) proof (state)
goal (1 subgoal):
 1. ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 buffer)\<rbrace>) hs (do ms <- makeFaultMessage ft sender;
setMRs receiver buffer (snd ms)
od) (Call setMRs_fault_'proc) proof (state)
this:
\<lbrakk>\<And>s. ?\<Gamma>\<turnstile> (UNIV \<inter> {s'. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> (s, s') \<in> ?sr}) ?m ({s'. (s, s') \<in> ?sr} \<inter> \<lbrace>\<acute>ret__unsigned = ?val\<rbrace>); \<And>rv' t t'. ceqv ?\<Gamma> ret__unsigned_' rv' t t' ?y (?y' rv'); ccorres_underlying ?sr ?\<Gamma> ?r ?xf ?arrel ?axf ?P ?Q ?hs ?a (?y' ?val); guard_is_UNIV (\<lambda>rv rv'. rv' = ?val) ret__unsigned_' (\<lambda>rv rv'. ?Q)\<rbrakk> \<Longrightarrow> ccorres_underlying ?sr ?\<Gamma> ?r ?xf ?arrel ?axf (?P and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) UNIV ?hs ?a (?m;;
?y)

goal (1 subgoal):
 1. ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 buffer)\<rbrace>) hs (do ms <- makeFaultMessage ft sender;
setMRs receiver buffer (snd ms)
od) (Call setMRs_fault_'proc) proof (state)
this:
empty_fail ?f \<Longrightarrow> empty_fail (K_bind ?f ?x)
empty_fail (?f ?x) \<Longrightarrow> empty_fail (?f $ ?x)
\<lbrakk>?P \<Longrightarrow> empty_fail ?f; \<not> ?P \<Longrightarrow> empty_fail ?g\<rbrakk> \<Longrightarrow> empty_fail (if ?P then ?f else ?g)
\<lbrakk>?P \<Longrightarrow> empty_fail (?f ?x); \<not> ?P \<Longrightarrow> empty_fail (?g ?x)\<rbrakk> \<Longrightarrow> empty_fail ((if ?P then ?f else ?g) ?x)
?S \<noteq> {} \<Longrightarrow> empty_fail (select ?S)
(fst ?S = {} \<Longrightarrow> snd ?S) \<Longrightarrow> empty_fail (select_f ?S)
\<lbrakk>empty_fail ?a; \<And>x. empty_fail (?b x)\<rbrakk> \<Longrightarrow> empty_fail (?a >>= ?b)
(\<And>x. empty_fail (?f x)) \<Longrightarrow> empty_fail (Nondet_Monad.lift ?f ?x)
empty_fail ?f \<Longrightarrow> empty_fail (liftE ?f)
\<lbrakk>empty_fail ?f; \<And>rv. empty_fail (?g rv)\<rbrakk> \<Longrightarrow> empty_fail (?f >>=E ?g)
(\<And>x. x \<in> set ?xs \<Longrightarrow> empty_fail (?m x)) \<Longrightarrow> empty_fail (mapM ?m ?xs)
(?P \<Longrightarrow> empty_fail ?f) \<Longrightarrow> empty_fail (whenE ?P ?f)
(\<not> ?P \<Longrightarrow> empty_fail ?f) \<Longrightarrow> empty_fail (unlessE ?P ?f)
\<lbrakk>empty_fail ?f; \<And>x. empty_fail (?g x)\<rbrakk> \<Longrightarrow> empty_fail (?f <catch> ?g)
(?P \<Longrightarrow> empty_fail ?x) \<Longrightarrow> empty_fail (when ?P ?x)
(\<not> ?P \<Longrightarrow> empty_fail ?f) \<Longrightarrow> empty_fail (unless ?P ?f)
empty_fail ?m \<Longrightarrow> empty_fail (liftM ?f ?m)
empty_fail ?m \<Longrightarrow> empty_fail (liftME ?f ?m)
\<lbrakk>empty_fail ?L; \<And>r. empty_fail (?R r)\<rbrakk> \<Longrightarrow> empty_fail (?L <handle> ?R)
\<lbrakk>empty_fail ?f; \<And>e. empty_fail (?handler e)\<rbrakk> \<Longrightarrow> empty_fail (?f <handle2> ?handler)
(\<And>m. m \<in> set ?ms \<Longrightarrow> empty_fail m) \<Longrightarrow> empty_fail (Nondet_Monad.sequence ?ms)
(\<And>m. m \<in> set ?ms \<Longrightarrow> empty_fail m) \<Longrightarrow> empty_fail (sequence_x ?ms)
(\<And>m. m \<in> set ?ms \<Longrightarrow> empty_fail m) \<Longrightarrow> empty_fail (sequenceE ?ms)
(\<And>m. m \<in> set ?ms \<Longrightarrow> empty_fail m) \<Longrightarrow> empty_fail (sequenceE_x ?ms)
(\<And>m. m \<in> ?f ` set ?ms \<Longrightarrow> empty_fail m) \<Longrightarrow> empty_fail (mapM_x ?f ?ms)
(\<And>m. m \<in> ?f ` set ?xs \<Longrightarrow> empty_fail m) \<Longrightarrow> empty_fail (mapME ?f ?xs)
(\<And>m'. m' \<in> ?f ` set ?xs \<Longrightarrow> empty_fail m') \<Longrightarrow> empty_fail (mapME_x ?f ?xs)
(\<And>m. m \<in> set ?ms \<Longrightarrow> empty_fail (?P m)) \<Longrightarrow> empty_fail (filterM ?P ?ms)
(\<And>x y. empty_fail (?f x y)) \<Longrightarrow> empty_fail (zipWithM_x ?f ?xs ?ys)
(\<And>x y. empty_fail (?f x y)) \<Longrightarrow> empty_fail (zipWithM ?f ?xs ?ys)
\<forall>x. empty_fail (?f x) \<Longrightarrow> empty_fail (maybeM ?f ?t)
\<lbrakk>empty_fail ?P; empty_fail ?a; empty_fail ?b\<rbrakk> \<Longrightarrow> empty_fail (ifM ?P ?a ?b)
\<lbrakk>empty_fail ?P; empty_fail ?a; empty_fail ?b\<rbrakk> \<Longrightarrow> empty_fail (ifME ?P ?a ?b)
\<lbrakk>empty_fail ?P; empty_fail ?f\<rbrakk> \<Longrightarrow> empty_fail (whenM ?P ?f)
\<lbrakk>empty_fail ?A; empty_fail ?B\<rbrakk> \<Longrightarrow> empty_fail (andM ?A ?B)
\<lbrakk>empty_fail ?A; empty_fail ?B\<rbrakk> \<Longrightarrow> empty_fail (orM ?A ?B)
empty_fail ?A \<Longrightarrow> empty_fail (notM ?A)
(\<And>r. empty_fail (?B r)) \<Longrightarrow> empty_fail (whileLoop ?C
  ?B ?r)
(\<And>r. empty_fail (?B r)) \<Longrightarrow> empty_fail (whileLoopE ?C
  ?B ?r)
\<lbrakk>empty_fail ?C; empty_fail ?B\<rbrakk> \<Longrightarrow> empty_fail (whileM ?C ?B)

goal (1 subgoal):
 1. ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 buffer)\<rbrace>) hs (do ms <- makeFaultMessage ft sender;
setMRs receiver buffer (snd ms)
od) (Call setMRs_fault_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 buffer)\<rbrace>) hs (do ms <- makeFaultMessage ft sender;
setMRs receiver buffer (snd ms)
od) (Call setMRs_fault_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>y. buffer \<noteq> Some 0) and (\<lambda>y. sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 buffer)\<rbrace>) hs (do ms <- makeFaultMessage ft sender;
setMRs receiver buffer (snd ms)
od) (Call setMRs_fault_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 buffer)\<rbrace>) hs (do ms <- makeFaultMessage ft sender;
setMRs receiver buffer (snd ms)
od) (Call setMRs_fault_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2410 receiveIPCBuffer receivera sendera) (?Q'2410 receiveIPCBuffer receivera sendera) (SKIP # hs) (do ms <- makeFaultMessage ft sender;
setMRs receiver buffer (snd ms)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c sendera} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(sendera\<rightarrow>[''tcbFault_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(sendera);;
CALL setMR_'proc(receivera,receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sendera} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(sendera\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(receivera,receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sendera} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(sendera\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(receivera,receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sendera} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(receivera,receiveIPCBuffer,h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(sendera\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(sendera,receivera,SCAST(32 signed \<rightarrow> 32 signed) MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,receiveIPCBuffer);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sendera} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(sendera\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(receivera,receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(sendera,receivera,SCAST(32 signed \<rightarrow> 32 signed) MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,receiveIPCBuffer);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sendera} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(sendera\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(receivera,receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c sendera} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(sendera\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(receivera,receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c sendera} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(sendera\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(sendera,receivera,receiveIPCBuffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2410 receiveIPCBuffer receivera sendera s \<and> s' \<in> ?Q'2410 receiveIPCBuffer receivera sendera proof (prove)
goal (2 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2410 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) (?Q'2410 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) (SKIP # hs) (do ms <- case ft of Fault_H.fault.UserException exception code \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.exceptionMessage;
return (3, msg @ [exception, code])
od | Fault_H.fault.CapFault cptr rp lf \<Rightarrow> do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr cptr # fromIntegral (fromEnum rp) # msgFromLookupFailure lf)
od | Fault_H.fault.UnknownSyscallException n \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [n])
od | Fault_H.fault.ArchFault af \<Rightarrow> makeArchFaultMessage af sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd ms);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2410 receiveIPCBuffer receivera sendera s \<and> s' \<in> ?Q'2410 receiveIPCBuffer receivera sendera proof (prove)
goal (5 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = fault_to_fault_tag ft\<rbrace>)
 2. \<And>receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI) (?y'2417 receiveIPCBuffer receivera sendera rv')
 3. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P2420 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) (?Q2417 receiveIPCBuffer receivera sendera) (SKIP # hs) (do ms <- case ft of Fault_H.fault.UserException exception code \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.exceptionMessage;
return (3, msg @ [exception, code])
od | Fault_H.fault.CapFault cptr rp lf \<Rightarrow> do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr cptr # fromIntegral (fromEnum rp) # msgFromLookupFailure lf)
od | Fault_H.fault.UnknownSyscallException n \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [n])
od | Fault_H.fault.ArchFault af \<Rightarrow> makeArchFaultMessage af sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd ms);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (?y'2417 receiveIPCBuffer receivera sendera (fault_to_fault_tag ft))
 4. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. ?Q2417 receiveIPCBuffer receivera sendera)
 5. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2420 receiveIPCBuffer receivera sendera and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender \<and> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag ft
 2. \<And>receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI) (?y'2417 receiveIPCBuffer receivera sendera rv')
 3. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P2420 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) (?Q2417 receiveIPCBuffer receivera sendera) (SKIP # hs) (do ms <- case ft of Fault_H.fault.UserException exception code \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.exceptionMessage;
return (3, msg @ [exception, code])
od | Fault_H.fault.CapFault cptr rp lf \<Rightarrow> do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr cptr # fromIntegral (fromEnum rp) # msgFromLookupFailure lf)
od | Fault_H.fault.UnknownSyscallException n \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [n])
od | Fault_H.fault.ArchFault af \<Rightarrow> makeArchFaultMessage af sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd ms);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (?y'2417 receiveIPCBuffer receivera sendera (fault_to_fault_tag ft))
 4. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. ?Q2417 receiveIPCBuffer receivera sendera)
 5. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2420 receiveIPCBuffer receivera sendera and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; (s, x) \<in> rf_sr; \<exists>ko ko'. ko_at' ko sender s \<and> tcbFault ko = Some ft \<and> cslift x (tcb_ptr_to_ctcb_ptr sender) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender \<and> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag ft
 2. \<And>receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI) (?y'2417 receiveIPCBuffer receivera sendera rv')
 3. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P2420 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) (?Q2417 receiveIPCBuffer receivera sendera) (SKIP # hs) (do ms <- case ft of Fault_H.fault.UserException exception code \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.exceptionMessage;
return (3, msg @ [exception, code])
od | Fault_H.fault.CapFault cptr rp lf \<Rightarrow> do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr cptr # fromIntegral (fromEnum rp) # msgFromLookupFailure lf)
od | Fault_H.fault.UnknownSyscallException n \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [n])
od | Fault_H.fault.ArchFault af \<Rightarrow> makeArchFaultMessage af sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd ms);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (?y'2417 receiveIPCBuffer receivera sendera (fault_to_fault_tag ft))
 4. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. ?Q2417 receiveIPCBuffer receivera sendera)
 5. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2420 receiveIPCBuffer receivera sendera and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI) (?y'2417 receiveIPCBuffer receivera sendera rv')
 2. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P2420 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) (?Q2417 receiveIPCBuffer receivera sendera) (SKIP # hs) (do ms <- case ft of Fault_H.fault.UserException exception code \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.exceptionMessage;
return (3, msg @ [exception, code])
od | Fault_H.fault.CapFault cptr rp lf \<Rightarrow> do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr cptr # fromIntegral (fromEnum rp) # msgFromLookupFailure lf)
od | Fault_H.fault.UnknownSyscallException n \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [n])
od | Fault_H.fault.ArchFault af \<Rightarrow> makeArchFaultMessage af sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd ms);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (?y'2417 receiveIPCBuffer receivera sendera (fault_to_fault_tag ft))
 3. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. ?Q2417 receiveIPCBuffer receivera sendera)
 4. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2420 receiveIPCBuffer receivera sendera and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P2420 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) (?Q2417 receiveIPCBuffer receivera sendera) (SKIP # hs) (do ms <- case ft of Fault_H.fault.UserException exception code \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.exceptionMessage;
return (3, msg @ [exception, code])
od | Fault_H.fault.CapFault cptr rp lf \<Rightarrow> do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr cptr # fromIntegral (fromEnum rp) # msgFromLookupFailure lf)
od | Fault_H.fault.UnknownSyscallException n \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [n])
od | Fault_H.fault.ArchFault af \<Rightarrow> makeArchFaultMessage af sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd ms);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. ?Q2417 receiveIPCBuffer receivera sendera)
 3. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2420 receiveIPCBuffer receivera sendera and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P2420 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) (?Q2417 receiveIPCBuffer receivera sendera) (SKIP # hs) (do ms <- case ft of Fault_H.fault.UserException exception code \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.exceptionMessage;
return (3, msg @ [exception, code])
od | Fault_H.fault.CapFault cptr rp lf \<Rightarrow> do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr cptr # fromIntegral (fromEnum rp) # msgFromLookupFailure lf)
od | Fault_H.fault.UnknownSyscallException n \<Rightarrow> do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [n])
od | Fault_H.fault.ArchFault af \<Rightarrow> makeArchFaultMessage af sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd ms);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. ?Q2417 receiveIPCBuffer receivera sendera)
 3. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2420 receiveIPCBuffer receivera sendera and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12) (?R''3411 receiveIPCBuffer receivera sendera x11 x12) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.exceptionMessage;
return (3, msg @ [x11, x12])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> ?R''3411 receiveIPCBuffer receivera sendera x xa}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 6. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> ?R3437 receiveIPCBuffer receivera sendera x xa a) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12) (?R''3411 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12) (SKIP # hs) (do msg <- asUser sender (mapM getRegister FaultHandler_H.exceptionMessage);
y <- stateAssert (tcb_at' receiver) [];
x <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [0..<msgMaxLength] msg);
y <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [length msg..<msgMaxLength] [x11, x12]);
return (word_of_nat (if x = [] \<and> y = [] then 0 else last (x @ y)))
od) (CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> ?R''3411 receiveIPCBuffer receivera sendera x xa}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 6. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> ?R3437 receiveIPCBuffer receivera sendera x xa a) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q3467 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) (?Q'3465 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) (SKIP # hs) (do y <- stateAssert (tcb_at' receiver) [];
x <- mapM (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<msgMaxLength] msg);
y <- mapM (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [length msg..<msgMaxLength] [x11, x12]);
return (word_of_nat (if x = [] \<and> y = [] then 0 else last (x @ y)))
od) (CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>?Q3467 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q3467 receiveIPCBuffer receivera sendera x xa rv s \<longrightarrow> s' \<in> ?Q'3465 receiveIPCBuffer receivera sendera x xa rv}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> ?R3437 receiveIPCBuffer receivera sendera x xa a) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P3474 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) (?Q'3465 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) (SKIP # hs) (do x <- mapM (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<msgMaxLength] msg);
y <- mapM (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [length msg..<msgMaxLength] [x11, x12]);
return (word_of_nat (if x = [] \<and> y = [] then 0 else last (x @ y)))
od) (CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> ?P3474 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a b\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> ?P3474 receiveIPCBuffer receivera sendera x xa rv s) \<longrightarrow> s' \<in> ?Q'3465 receiveIPCBuffer receivera sendera x xa rv}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> ?R3437 receiveIPCBuffer receivera sendera x xa a) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = unat n_exceptionMessage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?G3481 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) (?Q'3465 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) (SKIP # hs) (do x <- mapM (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<msgMaxLength] msg);
y <- mapM (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [length msg..<msgMaxLength] [x11, x12]);
return (word_of_nat (if x = [] \<and> y = [] then 0 else last (x @ y)))
od) (CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (?G3481 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (?G3481 receiveIPCBuffer receivera sendera x xa rv and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> ?Q'3465 receiveIPCBuffer receivera sendera x xa rv}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> ?R3437 receiveIPCBuffer receivera sendera x xa a) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?G3481 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) (?Q'3465 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) (SKIP # hs) (do _ <- mapM_x (\<lambda>(x, y). setMR receiver buffer x y) (zip [0..<120] msg);
y <- setMR receiver buffer 3 x11;
y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (?G3481 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (?G3481 receiveIPCBuffer receivera sendera x xa rv and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> ?Q'3465 receiveIPCBuffer receivera sendera x xa rv}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> ?R3437 receiveIPCBuffer receivera sendera x xa a) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?G3481 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) (?Q'3465 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) (SKIP # hs) (do _ <- mapM_x (\<lambda>(x, y). setMR receiver buffer x y) (zip [0..<120] msg);
y <- setMR receiver buffer 3 x11;
y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')))))
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (?G3481 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (?G3481 receiveIPCBuffer receivera sendera x xa rv and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> ?Q'3465 receiveIPCBuffer receivera sendera x xa rv}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> ?R3437 receiveIPCBuffer receivera sendera x xa a) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (11 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q3509 receiveIPCBuffer receivera sendera x11 x12 msg rv) (?Q'3509 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 3 x11;
y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'))))
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>?Q3509 receiveIPCBuffer receivera sendera x11 x12 msg\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'3509 receiveIPCBuffer receivera sendera x11 x12 msg rv (xfdc s)}
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 7. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 receiveIPCBuffer receivera sendera x xa rv and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> ?R'3510 receiveIPCBuffer receivera sendera x xa rv}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?A3553 receiveIPCBuffer receivera sendera x11 x12 msg rv) (?C'3552 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 3 x11;
y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'))))
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. ?A3553 receiveIPCBuffer receivera sendera x11 x12 msg a and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?C'3552 receiveIPCBuffer receivera sendera x11 x12 msg rv (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 7. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 receiveIPCBuffer receivera sendera x xa rv and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> ?R'3510 receiveIPCBuffer receivera sendera x xa rv}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = userExceptionNumber ft\<rbrace>)
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'))) (?y'3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P3558 receiveIPCBuffer receivera sendera x11 x12 msg rv) (?Q3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 3 x11;
y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (?y'3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc (userExceptionNumber ft))
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. ?Q3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. ?P3558 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 10. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x11 x12 msg s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; length msg = 3; obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x11 x12)) sender s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<and> number_CL (seL4_Fault_UserException_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])))) = x11
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'))) (?y'3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P3558 receiveIPCBuffer receivera sendera x11 x12 msg rv) (?Q3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 3 x11;
y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (?y'3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc (userExceptionNumber ft))
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. ?Q3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. ?P3558 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 10. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x11 x12 msg s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; length msg = 3; (s, x) \<in> rf_sr; \<exists>ko ko'. ko_at' ko sender s \<and> tcbFault ko = Some (Fault_H.fault.UserException x11 x12) \<and> cslift x (tcb_ptr_to_ctcb_ptr sender) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<and> number_CL (seL4_Fault_UserException_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])))) = x11
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'))) (?y'3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P3558 receiveIPCBuffer receivera sendera x11 x12 msg rv) (?Q3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 3 x11;
y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (?y'3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc (userExceptionNumber ft))
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. ?Q3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. ?P3558 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 10. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'))) (?y'3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rv')
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P3558 receiveIPCBuffer receivera sendera x11 x12 msg rv) (?Q3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 3 x11;
y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (?y'3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc (userExceptionNumber ft))
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. ?Q3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. ?P3558 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 9. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P3558 receiveIPCBuffer receivera sendera x11 x12 msg rv) (?Q3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 3 x11;
y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')))
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. ?Q3556 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. ?P3558 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 8. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva) (?Q'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc) (SKIP # hs) (do y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'))
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3949 receiveIPCBuffer receivera sendera x11 x12 msg rv\<rbrace> setMR receiver buffer 3 x11 \<lbrace>?Q3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> ?Q'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva (xfdc s)}
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and ?R3949 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 10. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?A3983 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva) (?C'3982 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc) (SKIP # hs) (do y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])));;
(\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'))
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3949 receiveIPCBuffer receivera sendera x11 x12 msg rv\<rbrace> setMR receiver buffer 3 x11 \<lbrace>\<lambda>rva. ?A3983 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rva and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> ?C'3982 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and ?R3949 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 10. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = userExceptionErrorCode ft\<rbrace>)
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_') (?y'3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P3988 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva) (?Q3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc) (SKIP # hs) (do y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (?y'3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc (userExceptionErrorCode ft))
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionErrorCode ft) ret__unsigned_' (\<lambda>rvb rv'. ?Q3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3949 receiveIPCBuffer receivera sendera x11 x12 msg rv\<rbrace> setMR receiver buffer 3 x11 \<lbrace>\<lambda>rva. ?P3988 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rva and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 8. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and ?R3949 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 10. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x11 x12 msg s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; length msg = 3; obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x11 x12)) sender s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<and> code_CL (seL4_Fault_UserException_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])))) = x12
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_') (?y'3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P3988 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva) (?Q3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc) (SKIP # hs) (do y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (?y'3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc (userExceptionErrorCode ft))
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionErrorCode ft) ret__unsigned_' (\<lambda>rvb rv'. ?Q3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3949 receiveIPCBuffer receivera sendera x11 x12 msg rv\<rbrace> setMR receiver buffer 3 x11 \<lbrace>\<lambda>rva. ?P3988 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rva and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 8. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and ?R3949 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 10. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x11 x12 msg s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; length msg = 3; (s, x) \<in> rf_sr; \<exists>ko ko'. ko_at' ko sender s \<and> tcbFault ko = Some (Fault_H.fault.UserException x11 x12) \<and> cslift x (tcb_ptr_to_ctcb_ptr sender) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<and> code_CL (seL4_Fault_UserException_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])))) = x12
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_') (?y'3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P3988 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva) (?Q3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc) (SKIP # hs) (do y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (?y'3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc (userExceptionErrorCode ft))
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionErrorCode ft) ret__unsigned_' (\<lambda>rvb rv'. ?Q3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3949 receiveIPCBuffer receivera sendera x11 x12 msg rv\<rbrace> setMR receiver buffer 3 x11 \<lbrace>\<lambda>rva. ?P3988 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rva and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 8. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and ?R3949 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 10. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_') (?y'3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc rv')
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P3988 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva) (?Q3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc) (SKIP # hs) (do y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (?y'3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc (userExceptionErrorCode ft))
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionErrorCode ft) ret__unsigned_' (\<lambda>rvb rv'. ?Q3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc)
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3949 receiveIPCBuffer receivera sendera x11 x12 msg rv\<rbrace> setMR receiver buffer 3 x11 \<lbrace>\<lambda>rva. ?P3988 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rva and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and ?R3949 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 9. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P3988 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva) (?Q3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc) (SKIP # hs) (do y <- setMR receiver buffer 4 x12;
return (word_of_nat y)
od) (\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,userExceptionErrorCode ft);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionErrorCode ft) ret__unsigned_' (\<lambda>rvb rv'. ?Q3986 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc)
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3949 receiveIPCBuffer receivera sendera x11 x12 msg rv\<rbrace> setMR receiver buffer 3 x11 \<lbrace>\<lambda>rva. ?P3988 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rva and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and ?R3949 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 8. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 10. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc rvb unsigned_eret_2. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc; rvb = unat (unsigned_eret_2 && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q4354 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc rvb) (?Q'4354 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc rvb unsigned_eret_2) (SKIP # hs) (return (word_of_nat rvb)) (return_C ret__unsigned_long_'_update (\<lambda>s. unsigned_eret_2))
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4356 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva\<rbrace> setMR receiver buffer 4 x12 \<lbrace>?Q4354 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4354 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc) \<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,userExceptionErrorCode ft) {s. \<forall>rvb. rvb = unat (unsigned_eret_2_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'4354 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc rvb (unsigned_eret_2_' s)}
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionErrorCode ft) ret__unsigned_' (\<lambda>rvb rv'. {s. reg_'_update (\<lambda>_. userExceptionErrorCode ft) (offset_'_update (\<lambda>_. 4) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 4\<rbrace> \<inter> \<lbrace>\<acute>reg = x12\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'4354 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3949 receiveIPCBuffer receivera sendera x11 x12 msg rv\<rbrace> setMR receiver buffer 3 x11 \<lbrace>\<lambda>rva. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 4 < msgMaxLength) and ?R4356 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rva and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 8. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and ?R3949 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 10. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4356 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva\<rbrace> setMR receiver buffer 4 x12 \<lbrace>\<lambda>rvb _. True\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4354 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc) \<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,userExceptionErrorCode ft) {s. \<forall>rv. rv = unat (unsigned_eret_2_' s && mask msgLengthBits) \<longrightarrow> s \<in> \<lbrace>word_of_nat rv = \<^bsup>s\<^esup>unsigned_eret_2 && mask msgLengthBits\<rbrace>}
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionErrorCode ft) ret__unsigned_' (\<lambda>rvb rv'. {s. reg_'_update (\<lambda>_. userExceptionErrorCode ft) (offset_'_update (\<lambda>_. 4) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 4\<rbrace> \<inter> \<lbrace>\<acute>reg = x12\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'4354 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc)
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3949 receiveIPCBuffer receivera sendera x11 x12 msg rv\<rbrace> setMR receiver buffer 3 x11 \<lbrace>\<lambda>rva. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 4 < msgMaxLength) and ?R4356 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc rva and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and ?R3949 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 9. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4354 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc) \<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,userExceptionErrorCode ft) {s. \<forall>rv. rv = unat (unsigned_eret_2_' s && mask msgLengthBits) \<longrightarrow> s \<in> \<lbrace>word_of_nat rv = \<^bsup>s\<^esup>unsigned_eret_2 && mask msgLengthBits\<rbrace>}
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionErrorCode ft) ret__unsigned_' (\<lambda>rvb rv'. {s. reg_'_update (\<lambda>_. userExceptionErrorCode ft) (offset_'_update (\<lambda>_. 4) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 4\<rbrace> \<inter> \<lbrace>\<acute>reg = x12\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'4354 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc)
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3949 receiveIPCBuffer receivera sendera x11 x12 msg rv\<rbrace> setMR receiver buffer 3 x11 \<lbrace>\<lambda>rva. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 4 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and ?R3949 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 8. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 10. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4354 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg () xfdca rva xfdc) \<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),4,x12) \<lbrace>True\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionErrorCode ft) ret__unsigned_' (\<lambda>rvb rv'. {s. reg_'_update (\<lambda>_. userExceptionErrorCode ft) (offset_'_update (\<lambda>_. 4) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 4\<rbrace> \<inter> \<lbrace>\<acute>reg = x12\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'4354 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc)
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3949 receiveIPCBuffer receivera sendera x11 x12 msg rv\<rbrace> setMR receiver buffer 3 x11 \<lbrace>\<lambda>rva. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 4 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and ?R3949 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 8. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 10. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionErrorCode ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. userExceptionErrorCode ft) (offset_'_update (\<lambda>_. 4) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 4\<rbrace> \<inter> \<lbrace>\<acute>reg = x12\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3949 receiveIPCBuffer receivera sendera x11 x12 msg rv\<rbrace> setMR receiver buffer 3 x11 \<lbrace>\<lambda>rva. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 4 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and ?R3949 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 10. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3949 receiveIPCBuffer receivera sendera x11 x12 msg rv\<rbrace> setMR receiver buffer 3 x11 \<lbrace>\<lambda>rva. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 4 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and ?R3949 receiveIPCBuffer receivera sendera x11 x12 msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 6. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 9. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdca) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,userExceptionNumber ft) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> 4 < msgMaxLength \<and> True \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) s) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 8. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3947 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg () xfdc) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),3,x11) UNIV
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3947 receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc)
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> 4 < msgMaxLength \<and> True \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) s) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 5. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 8. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = userExceptionNumber ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. userExceptionNumber ft) (offset_'_update (\<lambda>_. 3) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 3\<rbrace> \<inter> \<lbrace>\<acute>reg = x11\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> 4 < msgMaxLength \<and> True \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) s) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 4. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 7. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 receiveIPCBuffer receivera sendera x xa rv and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> ?R'3510 receiveIPCBuffer receivera sendera x xa rv}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 3 < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> 4 < msgMaxLength \<and> True \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) s) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 receiveIPCBuffer receivera sendera x xa rv and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> ?R'3510 receiveIPCBuffer receivera sendera x xa rv}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 10. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> ?R3437 receiveIPCBuffer receivera sendera x xa a) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<lbrace>?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg\<rbrace> mapM_x (\<lambda>a. setMR receiver buffer (fst a) (snd a)) (zip [0..<120] msg) \<lbrace>\<lambda>a b. valid_pspace' b \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) b \<and> 3 < msgMaxLength \<and> valid_pspace' b \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) b \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x11 x12)) sender b \<and> tcb_at' sender b \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x11 x12)) sender b \<and> tcb_at' sender b\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 3. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 a and (\<lambda>_. length a = unat n_exceptionMessage)) b\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R3517 receiveIPCBuffer receivera sendera x xa rv and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> ?R'3510 receiveIPCBuffer receivera sendera x xa rv}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 10. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> ?R3437 receiveIPCBuffer receivera sendera x xa a) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12; length msg = 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3510 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12 msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,3,PTR(32 word) (option_to_0 buffer)) UNIV
 2. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x11 x12)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x11 x12)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length a = unat n_exceptionMessage)) aa\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> ?R'3510 receiveIPCBuffer receivera sendera x xa rv}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> ?R3437 receiveIPCBuffer receivera sendera x xa a) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x11 x12)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x11 x12)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length a = unat n_exceptionMessage)) aa\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 8. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> ?R3437 receiveIPCBuffer receivera sendera x xa a) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender and K (length a = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x11 x12)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x11 x12)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length a = unat n_exceptionMessage)) aa\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 7. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> ?R3437 receiveIPCBuffer receivera sendera x xa a) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>?R3437 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x11 x12\<rbrace> asUser sender (mapM getRegister FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> valid_pspace' aa \<and> obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = a) sender aa \<and> length a = 3 \<and> valid_pspace' aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> 3 < msgMaxLength \<and> valid_pspace' aa \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x11 x12)) sender aa \<and> tcb_at' sender aa \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x11 x12)) sender aa \<and> tcb_at' sender aa \<and> length a = unat n_exceptionMessage\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 7. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> ?R3437 receiveIPCBuffer receivera sendera x xa a) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x11 x12. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.exceptionMessage))
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 6. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 5. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 receiveIPCBuffer receivera sendera x21 x22 x23) (SKIP # hs) (do a <- do pc <- asUser sender getRestartPC;
return (1, pc # fromCPtr x21 # fromIntegral (fromEnum x22) # msgFromLookupFailure x23)
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 5. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (SKIP # hs) (do pc <- asUser sender getRestartPC;
y <- stateAssert (tcb_at' receiver) [];
y <- setMR receiver buffer 0 pc;
y <- setMR receiver buffer (Suc 0) x21;
y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (\<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_')
 2. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 5. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3434 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (?R''3408 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23) (SKIP # hs) (do pc <- asUser sender getRestartPC;
y <- stateAssert (tcb_at' receiver) [];
y <- setMR receiver buffer 0 pc;
y <- setMR receiver buffer (Suc 0) x21;
y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (\<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_')))))))
 2. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''3408 receiveIPCBuffer receivera sendera x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 5. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R3434 receiveIPCBuffer receivera sendera x xa xb a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q4724 receiveIPCBuffer receivera sendera x21 x22 x23 rv) (?Q'4739 x21 x22 x23 rv ret__unsigned_long) (SKIP # hs) (do y <- stateAssert (tcb_at' receiver) [];
y <- setMR receiver buffer 0 rv;
y <- setMR receiver buffer (Suc 0) x21;
y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,ret__unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'))))))
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>?Q4724 receiveIPCBuffer receivera sendera x21 x22 x23\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'4738 receiveIPCBuffer receivera sendera x xa xb t rv}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 6. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x21 x22 x23 t rv. ?Q'4739 x21 x22 x23 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?Q'4738 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (6 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P5014 receiveIPCBuffer receivera sendera x21 x22 x23 rv) (?Q'4739 x21 x22 x23 rv ret__unsigned_long) (SKIP # hs) (do y <- setMR receiver buffer 0 rv;
y <- setMR receiver buffer (Suc 0) x21;
y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,ret__unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'))))))
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> ?P5014 receiveIPCBuffer receivera sendera x21 x22 x23 a b\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'4738 receiveIPCBuffer receivera sendera x xa xb t rv}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 6. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x21 x22 x23 t rv. ?Q'4739 x21 x22 x23 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?Q'4738 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (7 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q5020 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva) (?Q'5038 x21 x22 x23 rv ret__unsigned_long rva xfdc) (SKIP # hs) (do y <- setMR receiver buffer (Suc 0) x21;
y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_')))))
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>?Q5020 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'5039 receiveIPCBuffer receivera sendera x xa xb t rv ta rva}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 7. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV
flex-flex pairs:
?Q'5039 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? \<lambda>x21 x22 x23 t rv ta rva. ?Q'5038 x21 x22 x23 rv (ret__unsigned_long_' t) rva (xfdc ta) proof (prove)
goal (10 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = capFaultAddress ft\<rbrace>)
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_')))) (?y'5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P5077 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva) (?Q5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc) (SKIP # hs) (do y <- setMR receiver buffer (Suc 0) x21;
y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (?y'5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc (capFaultAddress ft))
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rvb rv'. ?Q5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. ?P5077 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 10. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>x21 x22 x23 s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.CapFault x21 x22 x23; obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.CapFault x21 x22 x23)) sender s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender \<and> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<and> ((\<exists>t. ret__unsigned_' t = seL4_Fault_CapFault_CL.address_CL (seL4_Fault_CapFault_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))))) \<longrightarrow> seL4_Fault_CapFault_CL.address_CL (seL4_Fault_CapFault_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])))) = x21)
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_')))) (?y'5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P5077 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva) (?Q5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc) (SKIP # hs) (do y <- setMR receiver buffer (Suc 0) x21;
y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (?y'5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc (capFaultAddress ft))
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rvb rv'. ?Q5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. ?P5077 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 10. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>x21 x22 x23 s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.CapFault x21 x22 x23; (s, x) \<in> rf_sr; \<exists>ko ko'. ko_at' ko sender s \<and> tcbFault ko = Some (Fault_H.fault.CapFault x21 x22 x23) \<and> cslift x (tcb_ptr_to_ctcb_ptr sender) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender \<and> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<and> ((\<exists>t. ret__unsigned_' t = seL4_Fault_CapFault_CL.address_CL (seL4_Fault_CapFault_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))))) \<longrightarrow> seL4_Fault_CapFault_CL.address_CL (seL4_Fault_CapFault_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])))) = x21)
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_')))) (?y'5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P5077 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva) (?Q5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc) (SKIP # hs) (do y <- setMR receiver buffer (Suc 0) x21;
y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (?y'5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc (capFaultAddress ft))
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rvb rv'. ?Q5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. ?P5077 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 10. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_')))) (?y'5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rv')
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P5077 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva) (?Q5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc) (SKIP # hs) (do y <- setMR receiver buffer (Suc 0) x21;
y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (?y'5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc (capFaultAddress ft))
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rvb rv'. ?Q5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc)
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. ?P5077 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P5077 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva) (?Q5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc) (SKIP # hs) (do y <- setMR receiver buffer (Suc 0) x21;
y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,capFaultAddress ft);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'))))
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rvb rv'. ?Q5073 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc)
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. ?P5077 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 8. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q5483 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb) (?Q'5483 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc) (SKIP # hs) (do y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_')))
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>?Q5483 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rvb rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'5483 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb (xfdc t)})
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (12 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = from_bool (capFaultInReceivePhase ft)\<rbrace>)
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_')) (?y'5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P5517 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb) (?Q5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc) (SKIP # hs) (do y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (?y'5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc (from_bool (capFaultInReceivePhase ft)))
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capFaultInReceivePhase ft)) ret__unsigned_' (\<lambda>rvc rv'. ?Q5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. ?P5517 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rvb and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 7. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x21 x22 x23 s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.CapFault x21 x22 x23; obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.CapFault x21 x22 x23)) sender s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender \<and> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<and> ((\<exists>t. ret__unsigned_' t = inReceivePhase_CL (seL4_Fault_CapFault_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))))) \<longrightarrow> inReceivePhase_CL (seL4_Fault_CapFault_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])))) = from_bool x22)
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_')) (?y'5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P5517 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb) (?Q5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc) (SKIP # hs) (do y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (?y'5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc (from_bool (capFaultInReceivePhase ft)))
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capFaultInReceivePhase ft)) ret__unsigned_' (\<lambda>rvc rv'. ?Q5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. ?P5517 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rvb and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 7. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x21 x22 x23 s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.CapFault x21 x22 x23; (s, x) \<in> rf_sr; \<exists>ko ko'. ko_at' ko sender s \<and> tcbFault ko = Some (Fault_H.fault.CapFault x21 x22 x23) \<and> cslift x (tcb_ptr_to_ctcb_ptr sender) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender \<and> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<and> ((\<exists>t. ret__unsigned_' t = inReceivePhase_CL (seL4_Fault_CapFault_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))))) \<longrightarrow> inReceivePhase_CL (seL4_Fault_CapFault_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])))) = from_bool x22)
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_')) (?y'5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P5517 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb) (?Q5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc) (SKIP # hs) (do y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (?y'5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc (from_bool (capFaultInReceivePhase ft)))
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capFaultInReceivePhase ft)) ret__unsigned_' (\<lambda>rvc rv'. ?Q5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc)
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. ?P5517 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rvb and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 7. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_')) (?y'5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc rv')
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P5517 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb) (?Q5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc) (SKIP # hs) (do y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (?y'5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc (from_bool (capFaultInReceivePhase ft)))
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capFaultInReceivePhase ft)) ret__unsigned_' (\<lambda>rvc rv'. ?Q5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc)
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. ?P5517 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rvb and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P5517 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb) (?Q5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc) (SKIP # hs) (do y <- setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22));
ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then y else last ys))
od) (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,from_bool (capFaultInReceivePhase ft));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'))
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capFaultInReceivePhase ft)) ret__unsigned_' (\<lambda>rvc rv'. ?Q5515 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc)
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. ?P5517 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rvb and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 10. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (11 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb; dc rvc xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q5915 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc) (?Q'5915 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc) (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then rvc else last ys))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_')
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5917 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb\<rbrace> setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22)) \<lbrace>?Q5915 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capFaultInReceivePhase ft)) ret__unsigned_' (\<lambda>rvc rv'. {s. reg_'_update (\<lambda>_. from_bool (capFaultInReceivePhase ft)) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc 0))\<rbrace> \<inter> \<lbrace>\<acute>reg = word_of_nat (fromEnum x22)\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rvc. dc rvc (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'5915 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc (xfdc t)})
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and ?R5917 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rvb and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb; dc rvc xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?A5949 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc) (?C'5948 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc) (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then rvc else last ys))
od) (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5917 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb\<rbrace> setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22)) \<lbrace>\<lambda>rvc. ?A5949 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc rvc and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capFaultInReceivePhase ft)) ret__unsigned_' (\<lambda>rvc rv'. {s. reg_'_update (\<lambda>_. from_bool (capFaultInReceivePhase ft)) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc 0))\<rbrace> \<inter> \<lbrace>\<acute>reg = word_of_nat (fromEnum x22)\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rvc. dc rvc (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?C'5948 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc (xfdc t) \<inter> \<lbrace>True\<rbrace>})
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and ?R5917 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rvb and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb; dc rvc xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P'5953 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc) (?Q5952 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc) (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23));
return (word_of_nat (if ys = [] then rvc else last ys))
od) (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5917 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb\<rbrace> setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22)) \<lbrace>\<lambda>rvc. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and ?P'5953 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc rvc and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capFaultInReceivePhase ft)) ret__unsigned_' (\<lambda>rvc rv'. {s. reg_'_update (\<lambda>_. from_bool (capFaultInReceivePhase ft)) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc 0))\<rbrace> \<inter> \<lbrace>\<acute>reg = word_of_nat (fromEnum x22)\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rvc. dc rvc (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<longrightarrow> s' \<in> ?Q5952 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc (xfdc t)} \<inter> \<lbrace>True\<rbrace>})
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and ?R5917 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rvb and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc rvd ret__unsigned. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb; dc rvc xfdc; rvd \<noteq> [] \<and> last rvd = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q5956 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc rvd) (?Q'5956 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc rvd ret__unsigned) (SKIP # hs) (return (word_of_nat (if rvd = [] then rvc else last rvd))) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned))
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5958 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc\<rbrace> mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23)) \<lbrace>?Q5956 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5917 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb\<rbrace> setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22)) \<lbrace>\<lambda>rvc. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. Suc (Suc (Suc 0)) + length (msgFromLookupFailure x23) < 120) and ?R5958 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc rvc) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capFaultInReceivePhase ft)) ret__unsigned_' (\<lambda>rvc rv'. {s. reg_'_update (\<lambda>_. from_bool (capFaultInReceivePhase ft)) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc 0))\<rbrace> \<inter> \<lbrace>\<acute>reg = word_of_nat (fromEnum x22)\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rvc. dc rvc (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<longrightarrow> s' \<in> {s. offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType) (luf_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C'']))) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace> \<inter> \<lbrace>map_option lookup_fault_to_H (lookup_fault_lift \<acute>luf) = Some x23\<rbrace> \<inter> \<lbrace>Suc (Suc (Suc 0)) = unat \<acute>offset\<rbrace>} \<inter> {s'. \<forall>ta rvd. rvd \<noteq> [] \<and> last rvd = unat (ret__unsigned_' ta && mask msgLengthBits) \<longrightarrow> s'\<lparr>globals := globals ta, ret__unsigned_' := ret__unsigned_' ta\<rparr> \<in> ?Q'5956 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc (xfdc t) rvd (ret__unsigned_' ta)}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and ?R5917 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rvb and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 7. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc rvd ret__unsigned. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; rvd \<noteq> [] \<and> last rvd = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q5956 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23 ret__unsigned_long ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc rvd) (?Q'5956 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23 ret__unsigned_long ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc rvd ret__unsigned) (SKIP # hs) (return (ret__unsigned && mask msgLengthBits)) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned))
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5958 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc\<rbrace> mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23)) \<lbrace>?Q5956 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5917 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb\<rbrace> setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22)) \<lbrace>\<lambda>rvc. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. Suc (Suc (Suc 0)) + length (msgFromLookupFailure x23) < 120) and ?R5958 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc rvc) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capFaultInReceivePhase ft)) ret__unsigned_' (\<lambda>rvc rv'. {s. reg_'_update (\<lambda>_. from_bool (capFaultInReceivePhase ft)) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc 0))\<rbrace> \<inter> \<lbrace>\<acute>reg = word_of_nat (fromEnum x22)\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rvc. dc rvc (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<longrightarrow> s' \<in> {s. offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType) (luf_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C'']))) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace> \<inter> \<lbrace>map_option lookup_fault_to_H (lookup_fault_lift \<acute>luf) = Some x23\<rbrace> \<inter> \<lbrace>Suc (Suc (Suc 0)) = unat \<acute>offset\<rbrace>} \<inter> {s'. \<forall>ta rvd. rvd \<noteq> [] \<and> last rvd = unat (ret__unsigned_' ta && mask msgLengthBits) \<longrightarrow> s'\<lparr>globals := globals ta, ret__unsigned_' := ret__unsigned_' ta\<rparr> \<in> ?Q'5956 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc (xfdc t) rvd (ret__unsigned_' ta)}} \<inter> \<lbrace>True\<rbrace>})
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and ?R5917 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rvb and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 7. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5958 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb rvc\<rbrace> mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [Suc (Suc (Suc 0))..<120] (msgFromLookupFailure x23)) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5917 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb\<rbrace> setMR receiver buffer (Suc (Suc 0)) (word_of_nat (fromEnum x22)) \<lbrace>\<lambda>rvc. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. Suc (Suc (Suc 0)) + length (msgFromLookupFailure x23) < 120) and ?R5958 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdc rvc) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capFaultInReceivePhase ft)) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. from_bool (capFaultInReceivePhase ft)) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc 0))\<rbrace> \<inter> \<lbrace>\<acute>reg = word_of_nat (fromEnum x22)\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<longrightarrow> s' \<in> {s. offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType) (luf_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C'']))) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace> \<inter> \<lbrace>map_option lookup_fault_to_H (lookup_fault_lift \<acute>luf) = Some x23\<rbrace> \<inter> \<lbrace>Suc (Suc (Suc 0)) = unat \<acute>offset\<rbrace>} \<inter> {s'. \<forall>t rv. rv \<noteq> [] \<and> last rv = unat (ret__unsigned_' t && mask msgLengthBits) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_' := ret__unsigned_' t\<rparr> \<in> \<lbrace>\<^bsup>t\<^esup>ret__unsigned && mask msgLengthBits = \<^bsup>t\<^esup>ret__unsigned && mask msgLengthBits\<rbrace>}} \<inter> \<lbrace>True\<rbrace>})
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and ?R5917 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc rvb and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca rvb xfdcb. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (capFaultInReceivePhase ft)) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. from_bool (capFaultInReceivePhase ft)) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc 0))\<rbrace> \<inter> \<lbrace>\<acute>reg = word_of_nat (fromEnum x22)\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<longrightarrow> s' \<in> {s. offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType) (luf_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C'']))) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace> \<inter> \<lbrace>map_option lookup_fault_to_H (lookup_fault_lift \<acute>luf) = Some x23\<rbrace> \<inter> \<lbrace>Suc (Suc (Suc 0)) = unat \<acute>offset\<rbrace>} \<inter> {s'. \<forall>t rv. rv \<noteq> [] \<and> last rv = unat (ret__unsigned_' t && mask msgLengthBits) \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_' := ret__unsigned_' t\<rparr> \<in> \<lbrace>\<^bsup>t\<^esup>ret__unsigned && mask msgLengthBits = \<^bsup>t\<^esup>ret__unsigned && mask msgLengthBits\<rbrace>}} \<inter> \<lbrace>True\<rbrace>})
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and (\<lambda>s. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> valid_pspace' s \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure x23) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) s) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>x21 x22 x23 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.CapFault x21 x22 x23; ret__unsigned_' s = from_bool x22\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase = 2 \<and> from_bool x22 = word_of_nat (fromEnum x22) \<and> (\<forall>t. (\<exists>sa. (sa, s\<lparr>globals := globals t\<rparr>) \<in> rf_sr \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.CapFault x21 x22 x23)) sender sa) \<longrightarrow> (\<exists>z. lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals t))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C'']))) = Some z \<and> lookup_fault_to_H z = x23) \<and> Suc (Suc (Suc 0)) = unat (SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType))
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and (\<lambda>s. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> valid_pspace' s \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure x23) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) s) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>x21 x22 x23 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.CapFault x21 x22 x23; ret__unsigned_' s = from_bool x22\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase = 2
 2. \<And>x21 x22 x23 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.CapFault x21 x22 x23; ret__unsigned_' s = from_bool x22\<rbrakk> \<Longrightarrow> from_bool x22 = word_of_nat (fromEnum x22) \<and> (\<forall>t. (\<exists>sa. (sa, s\<lparr>globals := globals t\<rparr>) \<in> rf_sr \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.CapFault x21 x22 x23)) sender sa) \<longrightarrow> (\<exists>z. lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals t))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C'']))) = Some z \<and> lookup_fault_to_H z = x23) \<and> Suc (Suc (Suc 0)) = unat (SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType))
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and (\<lambda>s. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> valid_pspace' s \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure x23) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) s) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 10. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>x21 x22 x23 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.CapFault x21 x22 x23; ret__unsigned_' s = from_bool x22\<rbrakk> \<Longrightarrow> from_bool x22 = word_of_nat (fromEnum x22) \<and> (\<forall>t. (\<exists>sa. (sa, s\<lparr>globals := globals t\<rparr>) \<in> rf_sr \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.CapFault x21 x22 x23)) sender sa) \<longrightarrow> (\<exists>z. lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals t))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C'']))) = Some z \<and> lookup_fault_to_H z = x23) \<and> Suc (Suc (Suc 0)) = unat (SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType))
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and (\<lambda>s. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> valid_pspace' s \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure x23) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) s) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>x21 x22 x23 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.CapFault x21 x22 x23; ret__unsigned_' s = from_bool x22\<rbrakk> \<Longrightarrow> from_bool x22 = word_of_nat (fromEnum x22)
 2. \<And>x21 x22 x23 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.CapFault x21 x22 x23; ret__unsigned_' s = from_bool x22\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>sa. (sa, s\<lparr>globals := globals t\<rparr>) \<in> rf_sr \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.CapFault x21 x22 x23)) sender sa) \<longrightarrow> (\<exists>z. lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals t))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C'']))) = Some z \<and> lookup_fault_to_H z = x23) \<and> Suc (Suc (Suc 0)) = unat (SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType)
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and (\<lambda>s. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> valid_pspace' s \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure x23) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) s) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 10. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>x21 x22 x23 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.CapFault x21 x22 x23; ret__unsigned_' s = from_bool x22\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>sa. (sa, s\<lparr>globals := globals t\<rparr>) \<in> rf_sr \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.CapFault x21 x22 x23)) sender sa) \<longrightarrow> (\<exists>z. lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals t))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C'']))) = Some z \<and> lookup_fault_to_H z = x23) \<and> Suc (Suc (Suc 0)) = unat (SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType)
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and (\<lambda>s. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> valid_pspace' s \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure x23) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) s) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>x21 x22 x23 s t sa. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.CapFault x21 x22 x23; ret__unsigned_' s = from_bool x22; (sa, s\<lparr>globals := globals t\<rparr>) \<in> rf_sr; obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.CapFault x21 x22 x23)) sender sa\<rbrakk> \<Longrightarrow> (\<exists>z. lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals t))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C'']))) = Some z \<and> lookup_fault_to_H z = x23) \<and> Suc (Suc (Suc 0)) = unat (SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType)
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and (\<lambda>s. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> valid_pspace' s \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure x23) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) s) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>x21 x22 x23 s t sa. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.CapFault x21 x22 x23; ret__unsigned_' s = from_bool x22; (sa, s\<lparr>globals := globals t\<rparr>) \<in> rf_sr; \<exists>ko ko'. ko_at' ko sender sa \<and> tcbFault ko = Some (Fault_H.fault.CapFault x21 x22 x23) \<and> cslift (s\<lparr>globals := globals t\<rparr>) (tcb_ptr_to_ctcb_ptr sender) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> (\<exists>z. lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals t))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C'']))) = Some z \<and> lookup_fault_to_H z = x23) \<and> Suc (Suc (Suc 0)) = unat (SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType)
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and (\<lambda>s. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> valid_pspace' s \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure x23) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) s) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva\<rbrace> setMR receiver buffer (Suc 0) x21 \<lbrace>\<lambda>rvb. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc 0) < msgMaxLength) and (\<lambda>s. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> valid_pspace' s \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure x23) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender)) s) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long rva xfdca. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long; dc rva xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capFaultAddress ft) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. capFaultAddress ft) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc 0)\<rbrace> \<inter> \<lbrace>\<acute>reg = x21\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 3. \<And>receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> \<lbrace>?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 rv\<rbrace> setMR receiver buffer 0 rv \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc 0 < msgMaxLength) and ?R5485 receiveIPCBuffer receivera sendera x21 x22 x23 rv ret__unsigned_long a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera x21 x22 x23. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>?R4733 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x21 x22 x23\<rbrace> asUser sender getRestartPC \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and ?R5033 receiveIPCBuffer receivera sendera x21 x22 x23 a) aa\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 8. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and ?R4733 receiveIPCBuffer receivera sendera x xa xb) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 4. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x3. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x3) (?R''3404 receiveIPCBuffer receivera sendera x3) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [x3])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 4. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number) (?R''3404 receiveIPCBuffer receivera sendera syscall_number) (SKIP # hs) (do a <- do msg <- asUser sender $ mapM getRegister FaultHandler_H.syscallMessage;
return (2, msg @ [syscall_number])
od;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 4. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number) (?R''3404 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number) (SKIP # hs) (do msg <- asUser sender (mapM getRegister FaultHandler_H.syscallMessage);
y <- stateAssert (tcb_at' receiver) [];
x <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [0..<msgMaxLength] msg);
y <- mapM (\<lambda>(x, y). setMR receiver buffer x y) (zip [length msg..<msgMaxLength] [syscall_number]);
return (word_of_nat (if x = [] \<and> y = [] then 0 else last (x @ y)))
od) (CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')
 2. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''3404 receiveIPCBuffer receivera sendera x}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 4. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q6339 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) (?Q'6337 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) (SKIP # hs) (do y <- stateAssert (tcb_at' receiver) [];
x <- mapM (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<msgMaxLength] msg);
y <- mapM (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [length msg..<msgMaxLength] [syscall_number]);
return (word_of_nat (if x = [] \<and> y = [] then 0 else last (x @ y)))
od) (CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')
 2. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>?Q6339 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 5. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q6339 receiveIPCBuffer receivera sendera x rv s \<longrightarrow> s' \<in> ?Q'6337 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 7. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P6346 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) (?Q'6337 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) (SKIP # hs) (do x <- mapM (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<msgMaxLength] msg);
y <- mapM (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [length msg..<msgMaxLength] [syscall_number]);
return (word_of_nat (if x = [] \<and> y = [] then 0 else last (x @ y)))
od) (CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')
 2. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> ?P6346 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a b\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 5. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> ?P6346 receiveIPCBuffer receivera sendera x rv s) \<longrightarrow> s' \<in> ?Q'6337 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 7. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = unat n_syscallMessage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?G6353 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) (?Q'6337 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) (SKIP # hs) (do x <- mapM (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<msgMaxLength] msg);
y <- mapM (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [length msg..<msgMaxLength] [syscall_number]);
return (word_of_nat (if x = [] \<and> y = [] then 0 else last (x @ y)))
od) (CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')
 2. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (?G6353 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) b\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 5. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (?G6353 receiveIPCBuffer receivera sendera x rv and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> ?Q'6337 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 7. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?G6353 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) (?Q'6337 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) (SKIP # hs) (do _ <- mapM_x (\<lambda>(x, y). setMR receiver buffer x y) (zip [0..<120] msg);
y <- setMR receiver buffer 12 syscall_number;
return (word_of_nat y)
od) (CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),0xC,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')
 2. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (?G6353 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) b\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 5. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (?G6353 receiveIPCBuffer receivera sendera x rv and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> ?Q'6337 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 7. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?G6353 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) (?Q'6337 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) (SKIP # hs) (do _ <- mapM_x (\<lambda>(x, y). setMR receiver buffer x y) (zip [0..<120] msg);
y <- setMR receiver buffer 12 syscall_number;
return (word_of_nat y)
od) (CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),0xC,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')))
 2. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a b. tcb_at' receiver b \<longrightarrow> (?G6353 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) b\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 5. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (?G6353 receiveIPCBuffer receivera sendera x rv and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> ?Q'6337 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 7. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q6374 receiveIPCBuffer receivera sendera syscall_number msg rv) (?Q'6374 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 12 syscall_number;
return (word_of_nat y)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),0xC,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'))
 2. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>?Q6374 receiveIPCBuffer receivera sendera syscall_number msg\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6374 receiveIPCBuffer receivera sendera syscall_number msg rv (xfdc s)}
 4. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 receiveIPCBuffer receivera sendera x rv and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> ?R'6375 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?A6418 receiveIPCBuffer receivera sendera syscall_number msg rv) (?C'6417 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 12 syscall_number;
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])));;
(\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),0xC,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'))
 2. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. ?A6418 receiveIPCBuffer receivera sendera syscall_number msg a and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?C'6417 receiveIPCBuffer receivera sendera syscall_number msg rv (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 receiveIPCBuffer receivera sendera x rv and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> ?R'6375 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (12 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = syscall_number\<rbrace>)
 2. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),0xC,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_') (?y'6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P6423 receiveIPCBuffer receivera sendera syscall_number msg rv) (?Q6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 12 syscall_number;
return (word_of_nat y)
od) (?y'6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc syscall_number)
 4. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = syscall_number) ret__unsigned_' (\<lambda>rva rv'. ?Q6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc)
 5. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. ?P6423 receiveIPCBuffer receivera sendera syscall_number msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 10. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>syscall_number msg s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; length msg = 12; obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException syscall_number)) sender s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<and> syscallNumber_CL (seL4_Fault_UnknownSyscall_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])))) = syscall_number
 2. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),0xC,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_') (?y'6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P6423 receiveIPCBuffer receivera sendera syscall_number msg rv) (?Q6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 12 syscall_number;
return (word_of_nat y)
od) (?y'6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc syscall_number)
 4. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = syscall_number) ret__unsigned_' (\<lambda>rva rv'. ?Q6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc)
 5. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. ?P6423 receiveIPCBuffer receivera sendera syscall_number msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 10. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>syscall_number msg s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; length msg = 12; (s, x) \<in> rf_sr; \<exists>ko ko'. ko_at' ko sender s \<and> tcbFault ko = Some (Fault_H.fault.UnknownSyscallException syscall_number) \<and> cslift x (tcb_ptr_to_ctcb_ptr sender) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<and> syscallNumber_CL (seL4_Fault_UnknownSyscall_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])))) = syscall_number
 2. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),0xC,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_') (?y'6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc rv')
 3. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P6423 receiveIPCBuffer receivera sendera syscall_number msg rv) (?Q6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 12 syscall_number;
return (word_of_nat y)
od) (?y'6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc syscall_number)
 4. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = syscall_number) ret__unsigned_' (\<lambda>rva rv'. ?Q6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc)
 5. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. ?P6423 receiveIPCBuffer receivera sendera syscall_number msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 10. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),0xC,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_') (?y'6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc rv')
 2. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P6423 receiveIPCBuffer receivera sendera syscall_number msg rv) (?Q6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 12 syscall_number;
return (word_of_nat y)
od) (?y'6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc syscall_number)
 3. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = syscall_number) ret__unsigned_' (\<lambda>rva rv'. ?Q6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc)
 4. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. ?P6423 receiveIPCBuffer receivera sendera syscall_number msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 6. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 9. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 receiveIPCBuffer receivera sendera x rv and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> ?R'6375 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P6423 receiveIPCBuffer receivera sendera syscall_number msg rv) (?Q6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc) (SKIP # hs) (do y <- setMR receiver buffer 12 syscall_number;
return (word_of_nat y)
od) (\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),0xC,syscall_number);;
return_C ret__unsigned_long_'_update unsigned_eret_2_')
 2. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = syscall_number) ret__unsigned_' (\<lambda>rva rv'. ?Q6421 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc)
 3. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. ?P6423 receiveIPCBuffer receivera sendera syscall_number msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 5. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 8. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 receiveIPCBuffer receivera sendera x rv and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> ?R'6375 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 10. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (12 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc rva unsigned_eret_2. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc; rva = unat (unsigned_eret_2 && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q6780 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc rva) (?Q'6780 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc rva unsigned_eret_2) (SKIP # hs) (return (word_of_nat rva)) (return_C ret__unsigned_long_'_update (\<lambda>s. unsigned_eret_2))
 2. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R6782 receiveIPCBuffer receivera sendera syscall_number msg rv\<rbrace> setMR receiver buffer 12 syscall_number \<lbrace>?Q6780 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6780 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc) \<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),0xC,syscall_number) {s. \<forall>rva. rva = unat (unsigned_eret_2_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'6780 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc rva (unsigned_eret_2_' s)}
 4. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = syscall_number) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. syscall_number) (offset_'_update (\<lambda>_. 0xC) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 12\<rbrace> \<inter> \<lbrace>\<acute>reg = syscall_number\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6780 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc)
 5. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 12 < msgMaxLength) and ?R6782 receiveIPCBuffer receivera sendera syscall_number msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 7. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 9. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 10. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R6782 receiveIPCBuffer receivera sendera syscall_number msg rv\<rbrace> setMR receiver buffer 12 syscall_number \<lbrace>\<lambda>rva _. True\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6780 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc) \<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),0xC,syscall_number) {s. \<forall>rv. rv = unat (unsigned_eret_2_' s && mask msgLengthBits) \<longrightarrow> s \<in> \<lbrace>word_of_nat rv = \<^bsup>s\<^esup>unsigned_eret_2 && mask msgLengthBits\<rbrace>}
 3. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = syscall_number) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. syscall_number) (offset_'_update (\<lambda>_. 0xC) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 12\<rbrace> \<inter> \<lbrace>\<acute>reg = syscall_number\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6780 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc)
 4. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 12 < msgMaxLength) and ?R6782 receiveIPCBuffer receivera sendera syscall_number msg a and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 6. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 8. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 9. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 10. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 receiveIPCBuffer receivera sendera x rv and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> ?R'6375 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6780 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc) \<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),0xC,syscall_number) {s. \<forall>rv. rv = unat (unsigned_eret_2_' s && mask msgLengthBits) \<longrightarrow> s \<in> \<lbrace>word_of_nat rv = \<^bsup>s\<^esup>unsigned_eret_2 && mask msgLengthBits\<rbrace>}
 2. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = syscall_number) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. syscall_number) (offset_'_update (\<lambda>_. 0xC) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 12\<rbrace> \<inter> \<lbrace>\<acute>reg = syscall_number\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6780 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc)
 3. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 5. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 8. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 receiveIPCBuffer receivera sendera x rv and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> ?R'6375 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 10. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6780 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg () xfdc) \<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),0xC,syscall_number) \<lbrace>True\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = syscall_number) ret__unsigned_' (\<lambda>rva rv'. {s. reg_'_update (\<lambda>_. syscall_number) (offset_'_update (\<lambda>_. 0xC) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 12\<rbrace> \<inter> \<lbrace>\<acute>reg = syscall_number\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6780 receiveIPCBuffer receivera sendera syscall_number msg rv xfdc)
 3. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 5. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 7. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 8. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 9. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 receiveIPCBuffer receivera sendera x rv and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> ?R'6375 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 10. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg rv xfdc. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12; dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = syscall_number) ret__unsigned_' (\<lambda>rv rv'. {s. reg_'_update (\<lambda>_. syscall_number) (offset_'_update (\<lambda>_. 0xC) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 12\<rbrace> \<inter> \<lbrace>\<acute>reg = syscall_number\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 4. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 6. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 7. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 8. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 receiveIPCBuffer receivera sendera x rv and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> ?R'6375 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 9. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver buffer a b) (zip [0..<120] msg) \<lbrace>\<lambda>a. valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 3. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number a and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 5. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 6. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R6382 receiveIPCBuffer receivera sendera x rv and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> ?R'6375 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 8. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>syscall_number msg. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.UnknownSyscallException syscall_number; length msg = 12\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6375 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number msg) CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,0xC,PTR(32 word) (option_to_0 buffer)) UNIV
 2. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))) and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 4. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 5. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> ?R'6375 receiveIPCBuffer receivera sendera x rv}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 7. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))) and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 4. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 6. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length a = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr sender))) and (\<lambda>_. length a = unat n_syscallMessage)) aa\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 3. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 5. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> \<lbrace>?R3431 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) syscall_number\<rbrace> asUser sender (mapM getRegister FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a aa. tcb_at' receiver aa \<longrightarrow> valid_pspace' aa \<and> obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = a) sender aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> length a = 12 \<and> valid_pspace' aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException syscall_number)) sender aa \<and> tcb_at' sender aa \<and> length a = unat n_syscallMessage\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 3. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 5. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R3431 receiveIPCBuffer receivera sendera x a) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera syscall_number. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.UnknownSyscallException syscall_number\<rbrakk> \<Longrightarrow> empty_fail (asUser sender (mapM getRegister FaultHandler_H.syscallMessage))
 2. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 4. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 3. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>a. ?R3417 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) a x4) (?R''3402 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  \<acute>ret__unsigned_long :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr sender);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP,\<acute>ret__unsigned_long);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_address_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_Addr,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_CapFault_get_inReceivePhase_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_InRecvPhase,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbLookupFailure_C''])),SCAST(32 signed \<rightarrow> 32) seL4_CapFault_LookupFailureType));;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''3402 receiveIPCBuffer receivera sendera x}})))
 3. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R3417 receiveIPCBuffer receivera sendera a x)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R7018 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (?R'7016 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Syscall,SCAST(32 signed \<rightarrow> 32) n_syscallMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UnknownSyscall_get_syscallNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_syscallMessage,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI)
 2. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R'7016 receiveIPCBuffer receivera sendera x \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 3. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R7018 receiveIPCBuffer receivera sendera x a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R7018 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (?R'7020 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,MessageID_Exception,SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,PTR(32 word) (option_to_0 buffer));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_number_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage,\<acute>ret__unsigned);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_UserException_get_code_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>unsigned_eret_2 :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),SCAST(32 signed \<rightarrow> 32) n_exceptionMessage + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update unsigned_eret_2_'
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI)
 2. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R'7020 receiveIPCBuffer receivera sendera x \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 3. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R7018 receiveIPCBuffer receivera sendera x a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R7018 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (?R'7023 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R'7023 receiveIPCBuffer receivera sendera x \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 3. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R7018 receiveIPCBuffer receivera sendera x a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R7018 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (?R'7023 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R'7023 receiveIPCBuffer receivera sendera x \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 3. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R7018 receiveIPCBuffer receivera sendera x a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R7018 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (?R'7023 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr sender} (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))));;
(\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R'7023 receiveIPCBuffer receivera sendera x \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 3. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> ?R7018 receiveIPCBuffer receivera sendera x a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?A7038 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (?C'7035 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C''])));;
(\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?C'7035 receiveIPCBuffer receivera sendera x \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 3. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (?A7038 receiveIPCBuffer receivera sendera x and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = fault_to_fault_tag ft\<rbrace>)
 2. \<And>receiveIPCBuffer receivera sendera x4 rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_') (?y'7041 receiveIPCBuffer receivera sendera x4 rv')
 3. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P7044 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (?Q7041 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (?y'7041 receiveIPCBuffer receivera sendera x4 (fault_to_fault_tag ft))
 4. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. ?Q7041 receiveIPCBuffer receivera sendera x4)
 5. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 6. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (?P7044 receiveIPCBuffer receivera sendera x and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>x4 s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.ArchFault x4)) sender s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = arch_fault_to_fault_tag x4
 2. \<And>receiveIPCBuffer receivera sendera x4 rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_') (?y'7041 receiveIPCBuffer receivera sendera x4 rv')
 3. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P7044 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (?Q7041 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (?y'7041 receiveIPCBuffer receivera sendera x4 (fault_to_fault_tag ft))
 4. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. ?Q7041 receiveIPCBuffer receivera sendera x4)
 5. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 6. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (?P7044 receiveIPCBuffer receivera sendera x and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>x4 s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; (s, x) \<in> rf_sr; \<exists>ko ko'. ko_at' ko sender s \<and> tcbFault ko = Some (Fault_H.fault.ArchFault x4) \<and> cslift x (tcb_ptr_to_ctcb_ptr sender) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr sender\<rightarrow>[''tcbFault_C'']))) = arch_fault_to_fault_tag x4
 2. \<And>receiveIPCBuffer receivera sendera x4 rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_') (?y'7041 receiveIPCBuffer receivera sendera x4 rv')
 3. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P7044 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (?Q7041 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (?y'7041 receiveIPCBuffer receivera sendera x4 (fault_to_fault_tag ft))
 4. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. ?Q7041 receiveIPCBuffer receivera sendera x4)
 5. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 6. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (?P7044 receiveIPCBuffer receivera sendera x and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4 rv' t t'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_') (?y'7041 receiveIPCBuffer receivera sendera x4 rv')
 2. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P7044 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (?Q7041 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (?y'7041 receiveIPCBuffer receivera sendera x4 (fault_to_fault_tag ft))
 3. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. ?Q7041 receiveIPCBuffer receivera sendera x4)
 4. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 5. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (?P7044 receiveIPCBuffer receivera sendera x and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P7044 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (?Q7041 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),fault_to_fault_tag ft);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. ?Q7041 receiveIPCBuffer receivera sendera x4)
 3. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 4. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (?P7044 receiveIPCBuffer receivera sendera x and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P7044 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4) (?Q7041 receiveIPCBuffer receivera sendera x4) (SKIP # hs) (do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od >>= return) (\<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),fault_to_fault_tag ft);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. ?Q7041 receiveIPCBuffer receivera sendera x4)
 3. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 4. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (?P7044 receiveIPCBuffer receivera sendera x and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4 rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4; rv = ret__unsigned_long && mask msgLengthBits\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q7401 receiveIPCBuffer receivera sendera x4 rv) (?Q'7401 receiveIPCBuffer receivera sendera x4 rv ret__unsigned_long) (SKIP # hs) (return rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<lbrace>?R7404 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4\<rbrace> do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od \<lbrace>?Q7401 receiveIPCBuffer receivera sendera x4\<rbrace>
 3. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7401 receiveIPCBuffer receivera sendera x4) \<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),fault_to_fault_tag ft) {s. \<forall>rv. rv = ret__unsigned_long_' s && mask msgLengthBits \<longrightarrow> s \<in> ?Q'7401 receiveIPCBuffer receivera sendera x4 rv (ret__unsigned_long_' s)}
 4. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. faultType_'_update (\<lambda>_. fault_to_fault_tag ft) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>faultType = fault_to_fault_tag (?ft7411 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4)\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 buffer)\<rbrace>} \<inter> ?R'7401 receiveIPCBuffer receivera sendera x4)
 5. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 6. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some (?ft7413 receiveIPCBuffer receivera sendera x)) sender and K (?ft7411 receiveIPCBuffer receivera sendera x = Fault_H.fault.ArchFault x) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R7404 receiveIPCBuffer receivera sendera x and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV
flex-flex pairs:
?ft7413 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? ?ft7411 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (5 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<lbrace>?R7404 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4\<rbrace> do a <- makeArchFaultMessage x4 sender;
y <- stateAssert (tcb_at' receiver) [];
ys <- zipWithM (setMR receiver buffer) [0..<msgMaxLength] (snd a);
return (word_of_nat (if ys = [] then 0 else last ys))
od \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7401 receiveIPCBuffer receivera sendera x4) \<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),fault_to_fault_tag ft) {s. \<forall>rv. rv = ret__unsigned_long_' s && mask msgLengthBits \<longrightarrow> s \<in> \<lbrace>rv = \<^bsup>s\<^esup>ret__unsigned_long && mask msgLengthBits\<rbrace>}
 3. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. faultType_'_update (\<lambda>_. fault_to_fault_tag ft) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>faultType = fault_to_fault_tag (?ft7411 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4)\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 buffer)\<rbrace>} \<inter> ?R'7401 receiveIPCBuffer receivera sendera x4)
 4. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 5. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some (?ft7413 receiveIPCBuffer receivera sendera x)) sender and K (?ft7411 receiveIPCBuffer receivera sendera x = Fault_H.fault.ArchFault x) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and ?R7404 receiveIPCBuffer receivera sendera x and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV
flex-flex pairs:
?ft7413 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? ?ft7411 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (4 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7401 receiveIPCBuffer receivera sendera x4) \<acute>ret__unsigned_long :== CALL Arch_setMRs_fault_'proc(tcb_ptr_to_ctcb_ptr sender,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 buffer),fault_to_fault_tag ft) {s. \<forall>rv. rv = ret__unsigned_long_' s && mask msgLengthBits \<longrightarrow> s \<in> \<lbrace>rv = \<^bsup>s\<^esup>ret__unsigned_long && mask msgLengthBits\<rbrace>}
 2. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. faultType_'_update (\<lambda>_. fault_to_fault_tag ft) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>faultType = fault_to_fault_tag (?ft7411 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4)\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 buffer)\<rbrace>} \<inter> ?R'7401 receiveIPCBuffer receivera sendera x4)
 3. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 4. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some (?ft7413 receiveIPCBuffer receivera sendera x)) sender and K (?ft7411 receiveIPCBuffer receivera sendera x = Fault_H.fault.ArchFault x) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV
flex-flex pairs:
?ft7413 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? ?ft7411 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (3 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera x4. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ft = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. faultType_'_update (\<lambda>_. fault_to_fault_tag ft) (receiveIPCBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 buffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>faultType = fault_to_fault_tag (?ft7411 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4)\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 buffer)\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 3. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some (?ft7413 receiveIPCBuffer receivera sendera x)) sender and K (?ft7411 receiveIPCBuffer receivera sendera x = Fault_H.fault.ArchFault x) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV
flex-flex pairs:
?ft7413 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? ?ft7411 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (3 subgoals):
 1. \<And>x4 s. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ft = Fault_H.fault.ArchFault x4; ret__unsigned_' s = arch_fault_to_fault_tag x4\<rbrakk> \<Longrightarrow> arch_fault_to_fault_tag x4 = fault_to_fault_tag (?ft7411 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) x4)
 2. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 3. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some (?ft7413 receiveIPCBuffer receivera sendera x)) sender and K (?ft7411 receiveIPCBuffer receivera sendera x = Fault_H.fault.ArchFault x) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV
flex-flex pairs:
?ft7413 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) \<equiv>\<^sup>? ?ft7411 (PTR(32 word) (option_to_0 buffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) proof (prove)
goal (2 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 2. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.ArchFault x)) sender and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag ft) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. ft = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.exceptionMessage = rv) sender and K (length rv = 3) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a) and (\<lambda>_. length rv = unat n_exceptionMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := 3\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 3\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. sendera) s \<in> \<lbrace>\<acute>thread = sendera\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. reg_'_update (\<lambda>_. ret__unsigned_long_' t) (offset_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_CapFault_IP) (receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (receiver_'_update (\<lambda>_. receivera) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rv\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buffer\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (tcb_at' receiver s \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = rv) sender and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length rv = 12) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 12 < msgMaxLength) and (\<lambda>_. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) and (\<lambda>_. length rv = unat n_syscallMessage)) s) \<longrightarrow> s' \<in> {s. receiveIPCBuffer_'_update (\<lambda>_. receiveIPCBuffer) (s\<lparr>sender_' := sendera, receiver_' := receivera, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := 0xC\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>sender = sendera\<rbrace> \<inter> \<lbrace>\<acute>receiver = receivera\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = receiveIPCBuffer\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. \<forall>x. s \<in> {s. ft = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall\<rbrace> \<inter> - \<lbrace>fault_to_fault_tag ft = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrace>}})))
 2. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.ArchFault x)) sender and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>s x. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ret__unsigned_' s = arch_fault_to_fault_tag x; ft = Fault_H.fault.ArchFault x\<rbrakk> \<Longrightarrow> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})
 2. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.ArchFault x)) sender and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>s x x1 x2. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; ret__unsigned_' s = arch_fault_to_fault_tag x; ft = Fault_H.fault.ArchFault x; x = ARM_H.VMFault x1 x2\<rbrakk> \<Longrightarrow> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})
 2. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.ArchFault x)) sender and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (1 subgoal):
 1. \<And>receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; receiveIPCBuffer = PTR(32 word) (option_to_0 buffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = 3 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 3 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 4 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.exceptionMessage = unat n_exceptionMessage) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' receiver a \<longrightarrow> (valid_pspace' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc 0 < msgMaxLength \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc 0) < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (Suc 0)) + length (msgFromLookupFailure xb) < 120 \<and> True \<and> tcb_at' (ctcb_ptr_to_tcb_ptr sendera) a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender a)) a)) a) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> length FaultHandler_H.syscallMessage = 12 \<and> valid_pspace' a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> 12 < msgMaxLength \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender a \<and> tcb_at' sender a \<and> length FaultHandler_H.syscallMessage = unat n_syscallMessage) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.ArchFault x)) sender and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver) and (\<lambda>a. True) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' (ctcb_ptr_to_tcb_ptr sendera)) a)) and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender) s \<and> s' \<in> UNIV proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; (s, s') \<in> rf_sr; valid_pspace' s; obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender s; tcb_at' receiver s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> tcb_at' sender s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender s \<and> tcb_at' sender s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender s \<and> tcb_at' sender s) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.CapFault x xa xb)) sender s \<and> length (msgFromLookupFailure xb) < 117 \<and> tcb_at' sender s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.CapFault x xa xb)) sender s) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> tcb_at' sender s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender s \<and> tcb_at' sender s) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.ArchFault x)) sender s \<and> tcb_at' sender s) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; (s, s') \<in> rf_sr; valid_pspace' s; tcb_at' receiver s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; \<exists>ko ko'. ko_at' ko sender s \<and> tcbFault ko = Some ft \<and> cslift s' (tcb_ptr_to_ctcb_ptr sender) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> (\<forall>x xa. ft = Fault_H.fault.UserException x xa \<longrightarrow> tcb_at' sender s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender s \<and> tcb_at' sender s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UserException x xa)) sender s \<and> tcb_at' sender s) \<and> (\<forall>x xa xb. ft = Fault_H.fault.CapFault x xa xb \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.CapFault x xa xb)) sender s \<and> length (msgFromLookupFailure xb) < 117 \<and> tcb_at' sender s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.CapFault x xa xb)) sender s) \<and> (\<forall>x. ft = Fault_H.fault.UnknownSyscallException x \<longrightarrow> tcb_at' sender s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.UnknownSyscallException x)) sender s \<and> tcb_at' sender s) \<and> (\<forall>x. ft = Fault_H.fault.ArchFault x \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = Some (Fault_H.fault.ArchFault x)) sender s \<and> tcb_at' sender s) proof (prove)
goal (1 subgoal):
 1. \<And>s s' koa obj ko' x xa xb. \<lbrakk>sender \<noteq> receiver; buffer \<noteq> Some 0; (s, s') \<in> rf_sr; valid_pspace' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; ksPSpace s receiver = Some (KOTCB obj); ksPSpace s sender = Some (KOTCB koa); is_aligned receiver tcbBlockSizeBits; is_aligned sender tcbBlockSizeBits; ps_clear receiver tcbBlockSizeBits s; ps_clear sender tcbBlockSizeBits s; tcbFault koa = Some (Fault_H.fault.CapFault x xa xb); cslift s' (tcb_ptr_to_ctcb_ptr sender) = Some ko'; ctcb_relation koa ko'; ft = Fault_H.fault.CapFault x xa xb\<rbrakk> \<Longrightarrow> length (msgFromLookupFailure xb) < 117 proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (valid_pspace' and obj_at' (\<lambda>tcb. tcbFault tcb = Some ft) sender and tcb_at' receiver and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (buffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 buffer)\<rbrace>) hs (do ms <- makeFaultMessage ft sender;
setMRs receiver buffer (snd ms)
od) (Call setMRs_fault_'proc)

goal:
No subgoals!