theory Ipc_C

lemma handleFaultReply_ccorres [corres]:
  "ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_'
           (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r
                          and (tcb_at' s and tcb_at' r)
                          and K (r \<noteq> s))
           (UNIV  \<inter> \<lbrace>cfault_rel (Some f)
                      (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs)
                         (Ptr &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))))
                      (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs)
                         (Ptr &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>
                  \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace>
                  \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace>) hs
           (do
              tag \<leftarrow> getMessageInfo s;
              sb \<leftarrow> lookupIPCBuffer False s;
              msg \<leftarrow> getMRs s sb tag;
              handleFaultReply f r (msgLabel tag) msg
            od) (Call handleFaultReply_'proc)" supply if_cong[cong] option.case_cong[cong] apply (unfold K_def, rule ccorres_gen_asm) apply (rule monadic_rewrite_ccorres_assemble_nodrop[OF _ handleFaultReply',rotated], simp) apply (cinit lift: sender_' receiver_' simp: whileAnno_def) apply clarsimp apply (ctac(c_lines 2) add: getMessageInfo_ccorres') apply (rename_tac tag tag') apply csymbr apply csymbr apply csymbr apply csymbr apply (rule ccorres_move_c_guard_tcb) apply (rule ccorres_symb_exec_r) apply (rule_tac val="fault_to_fault_tag f"
                   and xf'=ret__unsigned_'
                   and R="\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f"
                   and R'="\<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault)
                        (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs)
                           (Ptr &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>"
                    in ccorres_symb_exec_r_known_rv) apply (rule conseqPre, vcg, clarsimp) apply (erule(1) cmap_relation_ko_atE [OF cmap_relation_tcb]) apply (clarsimp simp: ctcb_relation_def typ_heap_simps
                                cfault_rel_def seL4_Fault_lift_def Let_def
                         split: if_split_asm) apply ceqv apply (simp add: handleFaultReply_def
                    del: Collect_const split del: if_split) apply wpc 
           (* UserException *)
            apply (rename_tac number code) apply (clarsimp simp: bind_assoc seL4_Fault_tag_defs ccorres_cond_iffs
                           split del: if_split) apply (subst take_min_len[symmetric,where n="unat (msgLength _)"]) apply (simp add: bind_assoc[symmetric]) apply (ctac add: copyMRsFaultReply_ccorres_exception) apply (ctac add: ccorres_return_C) apply wp apply (vcg exspec=copyMRsFaultReply_modifies) apply (wpsimp wp: threadGet_wp)+ 
          (* CapFault *)
           apply (clarsimp simp: bind_assoc seL4_Fault_tag_defs ccorres_cond_iffs
                          split del: if_split) apply (ctac add: ccorres_return_C) 
         (* UnknowSyscall *)
          apply (rename_tac number) apply (clarsimp simp: seL4_Fault_tag_defs ccorres_cond_iffs
                         split del: if_split) apply (subst take_min_len[symmetric,where n="unat (msgLength _)"]) apply (subst take_min_len[symmetric,where n="unat (msgLength _)"]) apply (fold bind_assoc) apply (ctac add: copyMRsFaultReply_ccorres_syscall[simplified bind_assoc[symmetric]]) apply (ctac add: ccorres_return_C) apply wp apply (vcg exspec=copyMRsFaultReply_modifies) apply (wpsimp wp: threadGet_wp)+ 

        (* ArchFault *)
         apply (rule ccorres_cond_false) apply (rule ccorres_cond_false) apply (rule ccorres_cond_false) apply (rule ccorres_rhs_assoc) 
        (* apply (rule_tac P="\<lambda>s. \<exists>t. ko_at' t r s" in ccorres_cross_over_guard) *)
         apply (rule_tac val="fault_to_fault_tag f"
                   and xf'=ret__unsigned_'
                   and R="\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f"
                   and R'="\<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault)
                        (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs)
                           (Ptr &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>"
                    in ccorres_symb_exec_r_known_rv_UNIV) apply (rule conseqPre, vcg, clarsimp) apply (erule(1) cmap_relation_ko_atE [OF cmap_relation_tcb]) apply (clarsimp simp: ctcb_relation_def typ_heap_simps
                                 cfault_rel_def seL4_Fault_lift_def Let_def
                           split: if_split_asm) apply ceqv apply (rule ccorres_add_return2) apply (ctac add: handleArchFaultReply_corres) apply (rule ccorres_return_C) apply simp+ apply wp apply (vcg exspec=Arch_handleFaultReply_modifies) apply (clarsimp simp: guard_is_UNIV_def) apply (subst fault_to_fault_tag.simps(2)) apply (clarsimp split: if_split) apply simp+ 
       (* Done *)
        apply clarsimp apply vcg apply vcg apply clarsimp apply vcg_step apply (clarsimp simp: n_exceptionMessage_def n_syscallMessage_def
                           message_info_to_H_def scast_def
                           length_exceptionMessage length_syscallMessage
                           min_def word_less_nat_alt
                           guard_is_UNIV_def seL4_Faults seL4_Arch_Faults
                       split: if_split) apply (simp add: length_exceptionMessage length_syscallMessage) apply wp apply clarsimp apply (vcg exspec=getRegister_modifies) apply (clarsimp simp: n_exceptionMessage_def n_syscallMessage_def
                        message_info_to_H_def length_exceptionMessage length_syscallMessage
                        min_def word_less_nat_alt obj_at'_def
                 split: if_split) using arch_fault_to_fault_tag_range apply (fastforce simp: seL4_Faults seL4_Arch_Faults) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r) and K (r \<noteq> s)) (UNIV \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace>) hs (do tag <- getMessageInfo s;
sb <- lookupIPCBuffer False s;
getMRs s sb tag >>= handleFaultReply f r (msgLabel tag)
od) (Call handleFaultReply_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r) and K (r \<noteq> s)) (UNIV \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace>) hs (do tag <- getMessageInfo s;
sb <- lookupIPCBuffer False s;
getMRs s sb tag >>= handleFaultReply f r (msgLabel tag)
od) (Call handleFaultReply_'proc) proof (prove)
goal (1 subgoal):
 1. r \<noteq> s \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) (UNIV \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace>) hs (do tag <- getMessageInfo s;
sb <- lookupIPCBuffer False s;
getMRs s sb tag >>= handleFaultReply f r (msgLabel tag)
od) (Call handleFaultReply_'proc) proof (prove)
goal (1 subgoal):
 1. r \<noteq> s \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) (UNIV \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace>) hs (handleFaultReply' f s r) (Call handleFaultReply_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>receiver sender. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?Q1131 receiver sender) (?Q'1131 receiver sender) (SKIP # hs) (do tag <- getMessageInfo s;
case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag
od) (\<acute>ret__unsigned_long :== CALL getRegister_'proc(sender,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
(\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(\<acute>tag);;
(\<acute>label___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>tag);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c receiver} (\<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(receiver\<rightarrow>[''tcbFault_C''])));;
(\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(sender,receiver,SCAST(32 signed \<rightarrow> 32 signed) MessageID_Syscall,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label___unsigned_long_' s = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(sender,receiver,SCAST(32 signed \<rightarrow> 32 signed) MessageID_Exception,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label___unsigned_long_' s = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(receiver,sender,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI))))))))
 2. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1131 receiver sender sa \<and> s' \<in> ?Q'1131 receiver sender proof (prove)
goal (2 subgoals):
 1. r \<noteq> s \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?Q1131 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) (?Q'1131 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) (SKIP # hs) (do tag <- getMessageInfo s;
case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag
od) (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
(\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(\<acute>tag);;
(\<acute>label___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>tag);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr r} (\<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])));;
(\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label___unsigned_long_' s = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label___unsigned_long_' s = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI))))))))
 2. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1131 receiver sender sa \<and> s' \<in> ?Q'1131 receiver sender proof (prove)
goal (4 subgoals):
 1. \<And>rv xfdc. \<lbrakk>r \<noteq> s; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?Q1145 rv) (?Q'1145 rv xfdc) (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength rv)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel rv = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength rv)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel rv = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r rv) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(xfdc);;
(\<acute>label___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr r} (\<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])));;
(\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label___unsigned_long_' s = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label___unsigned_long_' s = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI))))))
 2. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>?Q1145\<rbrace>
 3. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> ?Q'1145 rv (tag_' s)}
 4. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (4 subgoals):
 1. \<And>tag tag'. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?Q1145 tag) (?Q'1145 tag tag') (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_label_'proc(tag');;
(\<acute>label___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(tag');;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr r} (\<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])));;
(\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label___unsigned_long_' s = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label___unsigned_long_' s = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI))))))
 2. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>?Q1145\<rbrace>
 3. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> ?Q'1145 rv (tag_' s)}
 4. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (4 subgoals):
 1. \<And>tag tag' ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigned = label_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?Q1145 tag) (?G'1522 tag tag' ret__unsigned) (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag) (\<acute>label___unsigned_long :== ret__unsigned;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(tag');;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr r} (\<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])));;
(\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label___unsigned_long_' s = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label___unsigned_long_' s = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)))))
 2. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>?Q1145\<rbrace>
 3. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1522 rv (tag_' s) v}}
 4. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (4 subgoals):
 1. \<And>tag tag' ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigned = label_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?Q1145 tag) (?G'1626 tag tag' ret__unsigned) (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(tag');;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr r} (\<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])));;
(\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI))))
 2. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>?Q1145\<rbrace>
 3. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> ?G'1626 rv (tag_' s) v}}}
 4. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (4 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?Q1145 tag) (?G'1930 tag tag' ret__unsigneda ret__unsigned) (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag) (\<acute>length___unsigned_long :== ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr r} (\<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])));;
(\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if \<acute>length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then \<acute>length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)))
 2. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>?Q1145\<rbrace>
 3. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'1930 rv (tag_' s) v va}}}}
 4. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (4 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?Q1145 tag) (?G'2046 tag tag' ret__unsigneda ret__unsigned) (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr r} (\<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])));;
(\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI))
 2. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>?Q1145\<rbrace>
 3. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?G'2046 rv (tag_' s) v va}}}}}
 4. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (4 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?A2303 tag) (?C'2302 tag tag' ret__unsigneda ret__unsigned) (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag) (\<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']));;
(\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI))
 2. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. ?A2303 a and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 3. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 4. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (6 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?A2303 tag) (?Q'2306 tag tag' ret__unsigneda ret__unsigned) (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag) (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?Q'2306 tag tag' ret__unsigneda ret__unsigned)
 3. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ?A2303 tag sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 4. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. ?A2303 a and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 5. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 6. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (9 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> {s'. (\<exists>t. ko_at' t r sa \<and> tcbFault t = Some f) \<and> (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) ({s'. (sa, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = fault_to_fault_tag f\<rbrace>)
 2. \<And>tag tag' ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI) (?y'2310 tag tag' ret__unsigneda ret__unsigned rv')
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?P2312 tag) (?Q2310 tag tag' ret__unsigneda ret__unsigned) (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag) (?y'2310 tag tag' ret__unsigneda ret__unsigned (fault_to_fault_tag f))
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. \<forall>rv. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> s \<in> ?Q2310 tag tag' ret__unsigneda ret__unsigned}
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 6. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); (?P2312 tag and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 7. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. ?P2312 a and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 8. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 9. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (9 subgoals):
 1. \<And>sa x t ta. \<lbrakk>r \<noteq> s; cfault_rel (Some f) (seL4_Fault_lift (fault_' x)) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))); (sa, x) \<in> rf_sr; ko_at' t r sa; tcbFault t = Some f; ret__unsigned_' ta = seL4_Fault_get_tag (fault_' x)\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (fault_' x) = fault_to_fault_tag f
 2. \<And>tag tag' ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI) (?y'2310 tag tag' ret__unsigneda ret__unsigned rv')
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?P2312 tag) (?Q2310 tag tag' ret__unsigneda ret__unsigned) (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag) (?y'2310 tag tag' ret__unsigneda ret__unsigned (fault_to_fault_tag f))
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. \<forall>rv. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> s \<in> ?Q2310 tag tag' ret__unsigneda ret__unsigned}
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 6. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); (?P2312 tag and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 7. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. ?P2312 a and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 8. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 9. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (9 subgoals):
 1. \<And>sa x t ta ko'. \<lbrakk>r \<noteq> s; cfault_rel (Some f) (seL4_Fault_lift (fault_' x)) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))); ko_at' t r sa; tcbFault t = Some f; ret__unsigned_' ta = seL4_Fault_get_tag (fault_' x); cslift x (tcb_ptr_to_ctcb_ptr r) = Some ko'; ctcb_relation t ko'\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (fault_' x) = fault_to_fault_tag f
 2. \<And>tag tag' ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI) (?y'2310 tag tag' ret__unsigneda ret__unsigned rv')
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?P2312 tag) (?Q2310 tag tag' ret__unsigneda ret__unsigned) (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag) (?y'2310 tag tag' ret__unsigneda ret__unsigned (fault_to_fault_tag f))
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. \<forall>rv. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> s \<in> ?Q2310 tag tag' ret__unsigneda ret__unsigned}
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 6. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); (?P2312 tag and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 7. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. ?P2312 a and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 8. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 9. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (8 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned rv' t t'. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI) (?y'2310 tag tag' ret__unsigneda ret__unsigned rv')
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?P2312 tag) (?Q2310 tag tag' ret__unsigneda ret__unsigned) (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag) (?y'2310 tag tag' ret__unsigneda ret__unsigned (fault_to_fault_tag f))
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. \<forall>rv. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> s \<in> ?Q2310 tag tag' ret__unsigneda ret__unsigned}
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 5. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); (?P2312 tag and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 6. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. ?P2312 a and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 7. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 8. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (7 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?P2312 tag) (?Q2310 tag tag' ret__unsigneda ret__unsigned) (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigneda = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. \<forall>rv. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> s \<in> ?Q2310 tag tag' ret__unsigneda ret__unsigned}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); (?P2312 tag and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. ?P2312 a and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (7 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?P2312 (message_info_to_H tag')) (?Q2310 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag'))) (SKIP # hs) (case f of Fault_H.fault.UserException x xa \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od | Fault_H.fault.CapFault x xa xb \<Rightarrow> return True | Fault_H.fault.UnknownSyscallException x \<Rightarrow> do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od | Fault_H.fault.ArchFault af \<Rightarrow> handleArchFaultReply' af s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. \<forall>rv. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> s \<in> ?Q2310 tag tag' ret__unsigneda ret__unsigned}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); (?P2312 tag and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. ?P2312 a and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (10 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned x11 x12. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4258 (message_info_to_H tag') x11 x12) (?R''4242 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x11 x12) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>tag tag' ret__unsigneda ret__unsigned x21 x22 x23. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4254 (message_info_to_H tag') x21 x22 x23) (?R''4240 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x21 x22 x23) (SKIP # hs) (return True) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. \<forall>rv. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. f = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> ?R''4242 tag tag' ret__unsigneda ret__unsigned x xa}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''4240 tag tag' ret__unsigneda ret__unsigned x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 6. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 7. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> ?R4258 tag x xa a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 tag x xa xb a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 8. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> ?R4258 a x xa b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 a x xa xb b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 9. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 10. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (10 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned x11 x12. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UserException x11 x12\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4258 (message_info_to_H tag') x11 x12) (?R''4242 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x11 x12) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>tag tag' ret__unsigneda ret__unsigned x21 x22 x23. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4254 (message_info_to_H tag') x21 x22 x23) (?R''4240 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x21 x22 x23) (SKIP # hs) (return True) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. \<forall>rv. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. f = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> ?R''4242 tag tag' ret__unsigneda ret__unsigned x xa}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''4240 tag tag' ret__unsigneda ret__unsigned x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 6. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 7. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> ?R4258 tag x xa a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 tag x xa xb a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 8. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> ?R4258 a x xa b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 a x xa xb b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 9. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 10. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (10 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned number code. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UserException number code\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4258 (message_info_to_H tag') number code) (?R''4242 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) number code) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.exceptionMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>tag tag' ret__unsigneda ret__unsigned x21 x22 x23. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4254 (message_info_to_H tag') x21 x22 x23) (?R''4240 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x21 x22 x23) (SKIP # hs) (return True) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. \<forall>rv. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. f = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> ?R''4242 tag tag' ret__unsigneda ret__unsigned x xa}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''4240 tag tag' ret__unsigneda ret__unsigned x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 6. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 7. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> ?R4258 tag x xa a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 tag x xa xb a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 8. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> ?R4258 a x xa b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 a x xa xb b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 9. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 10. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (10 subgoals):
 1. \<And>tag' number code. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UserException number code\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4258 (message_info_to_H tag') number code) (?R''4242 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) number code) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take (unat (msgLength (message_info_to_H tag'))) FaultHandler_H.exceptionMessage);
return (msgLabel (message_info_to_H tag') = 0)
od) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0))
 2. \<And>tag tag' ret__unsigneda ret__unsigned x21 x22 x23. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4254 (message_info_to_H tag') x21 x22 x23) (?R''4240 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x21 x22 x23) (SKIP # hs) (return True) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. \<forall>rv. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. f = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> ?R''4242 tag tag' ret__unsigneda ret__unsigned x xa}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''4240 tag tag' ret__unsigneda ret__unsigned x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 6. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 7. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> ?R4258 tag x xa a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 tag x xa xb a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 8. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> ?R4258 a x xa b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 a x xa xb b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 9. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 10. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender proof (prove)
goal (10 subgoals):
 1. \<And>tag' number code. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UserException number code\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4286 tag' number code (message_info_to_H tag') (?number4286 tag' number code) (?code4286 tag' number code)) (?R''4286 tag' number code (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4286 tag' number code) (?code4286 tag' number code)) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take (min (length FaultHandler_H.exceptionMessage) (unat (msgLength (message_info_to_H tag')))) FaultHandler_H.exceptionMessage);
return (msgLabel (message_info_to_H tag') = 0)
od) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0))
 2. \<And>tag tag' ret__unsigneda ret__unsigned x21 x22 x23. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4254 (message_info_to_H tag') x21 x22 x23) (?R''4240 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x21 x22 x23) (SKIP # hs) (return True) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. \<forall>rv. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. f = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> ?R''4242 tag tag' ret__unsigneda ret__unsigned x xa}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''4240 tag tag' ret__unsigneda ret__unsigned x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 6. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 7. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> ?R4258 tag x xa a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 tag x xa xb a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 8. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> ?R4258 a x xa b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 a x xa xb b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 9. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 10. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag' number code. ?R''4286 tag' number code (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4286 tag' number code) (?code4286 tag' number code) \<equiv>\<^sup>? \<lambda>tag'. ?R''4242 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag'))
\<lambda>tag' number code. ?R4286 tag' number code (message_info_to_H tag') (?number4286 tag' number code) (?code4286 tag' number code) \<equiv>\<^sup>? \<lambda>tag'. ?R4258 (message_info_to_H tag') proof (prove)
goal (10 subgoals):
 1. \<And>tag' number code. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UserException number code\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4286 tag' number code (message_info_to_H tag') (?number4286 tag' number code) (?code4286 tag' number code)) (?R''4286 tag' number code (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4286 tag' number code) (?code4286 tag' number code)) (SKIP # hs) (do y <- do t <- local.getSanitiseRegisterInfo r;
zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take (min (length FaultHandler_H.exceptionMessage) (unat (msgLength (message_info_to_H tag')))) FaultHandler_H.exceptionMessage)
od;
return (msgLabel (message_info_to_H tag') = 0)
od) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0))
 2. \<And>tag tag' ret__unsigneda ret__unsigned x21 x22 x23. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4254 (message_info_to_H tag') x21 x22 x23) (?R''4240 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x21 x22 x23) (SKIP # hs) (return True) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. \<forall>rv. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> s \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. f = Fault_H.fault.UserException x xa \<longrightarrow> s \<in> ?R''4242 tag tag' ret__unsigneda ret__unsigned x xa}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''4240 tag tag' ret__unsigneda ret__unsigned x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 6. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 7. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> ?R4258 tag x xa a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 tag x xa xb a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 8. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> ?R4258 a x xa b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 a x xa xb b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 9. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 10. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag' number code. ?R''4286 tag' number code (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4286 tag' number code) (?code4286 tag' number code) \<equiv>\<^sup>? \<lambda>tag'. ?R''4242 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag'))
\<lambda>tag' number code. ?R4286 tag' number code (message_info_to_H tag') (?number4286 tag' number code) (?code4286 tag' number code) \<equiv>\<^sup>? \<lambda>tag'. ?R4258 (message_info_to_H tag') proof (prove)
goal (12 subgoals):
 1. \<And>tag' number code rv xfdc. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UserException number code; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?Q4295 tag' number code rv) (?Q'4295 tag' number code rv xfdc) (SKIP # hs) (return (msgLabel (message_info_to_H tag') = 0)) (return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0))
 2. \<And>tag' number code. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UserException number code\<rbrakk> \<Longrightarrow> \<lbrace>?R4310 tag' number code (message_info_to_H tag') r s\<rbrace> do t <- local.getSanitiseRegisterInfo r;
zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take (min (length FaultHandler_H.exceptionMessage) (unat (msgLength (message_info_to_H tag')))) FaultHandler_H.exceptionMessage)
od \<lbrace>?Q4295 tag' number code\<rbrace>
 3. \<And>tag' number code. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UserException number code\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4298 tag' number code (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) r s) CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4295 tag' number code rv (xfdc s)}
 4. \<And>tag tag' ret__unsigneda ret__unsigned x21 x22 x23. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4254 (message_info_to_H tag') x21 x22 x23) (?R''4240 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x21 x22 x23) (SKIP # hs) (return True) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 7. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> ?R'4300 tag tag' ret__unsigneda ret__unsigned x xa}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''4240 tag tag' ret__unsigneda ret__unsigned x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 8. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 9. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and ?R4312 tag x xa) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 tag x xa xb a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 10. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and ?R4312 a x xa) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 a x xa xb b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s
\<lambda>tag'. ?R4312 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?R4310 tag' number code (message_info_to_H tag') r s
\<lambda>tag'. ?R'4300 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) \<equiv>\<^sup>? \<lambda>tag' number code. ?R'4298 tag' number code (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) r s proof (prove)
goal (11 subgoals):
 1. \<And>tag' number code. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UserException number code\<rbrakk> \<Longrightarrow> \<lbrace>?R4310 tag' number code (message_info_to_H tag') r s\<rbrace> do t <- local.getSanitiseRegisterInfo r;
zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take (min (length FaultHandler_H.exceptionMessage) (unat (msgLength (message_info_to_H tag')))) FaultHandler_H.exceptionMessage)
od \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>tag' number code. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UserException number code\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4298 tag' number code (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) r s) CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>(msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)\<rbrace>}
 3. \<And>tag tag' ret__unsigneda ret__unsigned x21 x22 x23. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4254 (message_info_to_H tag') x21 x22 x23) (?R''4240 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x21 x22 x23) (SKIP # hs) (return True) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 6. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> ?R'4300 tag tag' ret__unsigneda ret__unsigned x xa}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''4240 tag tag' ret__unsigneda ret__unsigned x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 7. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 8. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and ?R4312 tag x xa) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 tag x xa xb a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 9. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and ?R4312 a x xa) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 a x xa xb b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 10. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s
\<lambda>tag'. ?R4312 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?R4310 tag' number code (message_info_to_H tag') r s
\<lambda>tag'. ?R'4300 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) \<equiv>\<^sup>? \<lambda>tag' number code. ?R'4298 tag' number code (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) r s proof (prove)
goal (10 subgoals):
 1. \<And>tag' number code. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UserException number code\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4298 tag' number code (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) r s) CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>(msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)\<rbrace>}
 2. \<And>tag tag' ret__unsigneda ret__unsigned x21 x22 x23. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4254 (message_info_to_H tag') x21 x22 x23) (?R''4240 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x21 x22 x23) (SKIP # hs) (return True) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> ?R'4300 tag tag' ret__unsigneda ret__unsigned x xa}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''4240 tag tag' ret__unsigneda ret__unsigned x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 6. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 7. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 tag x xa xb a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 8. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 a x xa xb b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 9. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 10. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s
\<lambda>tag'. ?R'4300 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) \<equiv>\<^sup>? \<lambda>tag' number code. ?R'4298 tag' number code (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) r s proof (prove)
goal (9 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned x21 x22 x23. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4254 (message_info_to_H tag') x21 x22 x23) (?R''4240 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x21 x22 x23) (SKIP # hs) (return True) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''4240 tag tag' ret__unsigneda ret__unsigned x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 6. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 tag x xa xb a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 7. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 a x xa xb b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 8. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 9. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (9 subgoals):
 1. \<And>tag' x21 x22 x23. \<lbrakk>r \<noteq> s; f = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4254 (message_info_to_H tag') x21 x22 x23) (?R''4240 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x21 x22 x23) (SKIP # hs) (return True) (Cond UNIV (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)) (Cond (if seL4_Fault_CapFault = seL4_Fault_UnknownSyscall then UNIV else {}) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)) (Cond (if seL4_Fault_CapFault = seL4_Fault_UserException then UNIV else {}) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)) (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''4240 tag tag' ret__unsigneda ret__unsigned x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 6. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 tag x xa xb a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 7. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 a x xa xb b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 8. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 9. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (9 subgoals):
 1. \<And>tag' x21 x22 x23. \<lbrakk>r \<noteq> s; f = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4254 (message_info_to_H tag') x21 x22 x23) (?R''4240 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x21 x22 x23) (SKIP # hs) (return True) (Cond UNIV (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)) (Cond (if seL4_Fault_CapFault = seL4_Fault_UnknownSyscall then UNIV else {}) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)) (Cond (if seL4_Fault_CapFault = seL4_Fault_UserException then UNIV else {}) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)) (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''4240 tag tag' ret__unsigneda ret__unsigned x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 6. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 tag x xa xb a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 7. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 a x xa xb b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 8. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 9. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (9 subgoals):
 1. \<And>tag' x21 x22 x23. \<lbrakk>r \<noteq> s; f = Fault_H.fault.CapFault x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4254 (message_info_to_H tag') x21 x22 x23) (?R''4240 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x21 x22 x23) (SKIP # hs) (return True) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true))
 2. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> ?R''4240 tag tag' ret__unsigneda ret__unsigned x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 6. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 tag x xa xb a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 7. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> ?R4254 a x xa xb b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 8. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 9. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (8 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 5. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 6. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 7. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 8. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (8 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned x3. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException x3\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') x3) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x3) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 5. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 6. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 7. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 8. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (8 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned number. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.UnknownSyscallException number\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') number) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) number) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
regs <- return $ take (unat (msgLength tag)) FaultHandler_H.syscallMessage;
zipWithM_x (\<lambda>rs rd. do v <- asUser s $ getRegister rs;
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) TCB_H.msgRegisters regs;
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + PPtr (i * 4));
asUser r $ setRegister rd $ local.sanitiseRegister t rd v
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) regs);
return (msgLabel tag = 0)
od) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 5. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 6. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 7. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 8. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (8 subgoals):
 1. \<And>tag' number. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UnknownSyscallException number\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4250 (message_info_to_H tag') number) (?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) number) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take (unat (msgLength (message_info_to_H tag'))) FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
a <- case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take (unat (msgLength (message_info_to_H tag'))) FaultHandler_H.syscallMessage));
return (msgLabel (message_info_to_H tag') = 0)
od) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0))
 2. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 5. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 6. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 7. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 8. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (8 subgoals):
 1. \<And>tag' number. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UnknownSyscallException number\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4410 tag' number (message_info_to_H tag') (?number4410 tag' number)) (?R''4410 tag' number (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4410 tag' number)) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
a <- case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take (unat (msgLength (message_info_to_H tag'))) FaultHandler_H.syscallMessage));
return (msgLabel (message_info_to_H tag') = 0)
od) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0))
 2. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 5. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 6. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 7. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 8. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag' number. ?R''4410 tag' number (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4410 tag' number) \<equiv>\<^sup>? \<lambda>tag'. ?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag'))
\<lambda>tag' number. ?R4410 tag' number (message_info_to_H tag') (?number4410 tag' number) \<equiv>\<^sup>? \<lambda>tag'. ?R4250 (message_info_to_H tag')
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (8 subgoals):
 1. \<And>tag' number. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UnknownSyscallException number\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4414 tag' tag' number (?numbera4413 tag' number) (message_info_to_H tag') (?number4413 tag' number tag' (?numbera4413 tag' number))) (?R''4415 tag' tag' number (?numbera4413 tag' number) (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4413 tag' number tag' (?numbera4413 tag' number))) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
a <- case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) FaultHandler_H.syscallMessage));
return (msgLabel (message_info_to_H tag') = 0)
od) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0))
 2. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 5. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 6. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 7. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 8. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag' number. ?R''4415 tag' tag' number (?numbera4413 tag' number) (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4413 tag' number tag' (?numbera4413 tag' number)) \<equiv>\<^sup>? \<lambda>tag' number. ?R''4410 tag' number (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4410 tag' number)
\<lambda>tag' number. ?R4414 tag' tag' number (?numbera4413 tag' number) (message_info_to_H tag') (?number4413 tag' number tag' (?numbera4413 tag' number)) \<equiv>\<^sup>? \<lambda>tag' number. ?R4410 tag' number (message_info_to_H tag') (?number4410 tag' number)
\<lambda>tag' number. ?R''4410 tag' number (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4410 tag' number) \<equiv>\<^sup>? \<lambda>tag'. ?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag'))
\<lambda>tag' number. ?R4410 tag' number (message_info_to_H tag') (?number4410 tag' number) \<equiv>\<^sup>? \<lambda>tag'. ?R4250 (message_info_to_H tag')
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (8 subgoals):
 1. \<And>tag' number. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UnknownSyscallException number\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4414 tag' tag' number (?numbera4413 tag' number) (message_info_to_H tag') (?number4413 tag' number tag' (?numbera4413 tag' number))) (?R''4415 tag' tag' number (?numbera4413 tag' number) (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4413 tag' number tag' (?numbera4413 tag' number))) (SKIP # hs) (do a <- do t <- local.getSanitiseRegisterInfo r;
do a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) FaultHandler_H.syscallMessage);
lookupIPCBuffer False s
od >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) FaultHandler_H.syscallMessage)))
od;
return (msgLabel (message_info_to_H tag') = 0)
od) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0))
 2. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({s. \<forall>x. s \<in> {s. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> s \<in> ?R''4238 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 5. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 tag x a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 6. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> ?R4250 a x b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 7. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 8. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag' number. ?R''4415 tag' tag' number (?numbera4413 tag' number) (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4413 tag' number tag' (?numbera4413 tag' number)) \<equiv>\<^sup>? \<lambda>tag' number. ?R''4410 tag' number (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4410 tag' number)
\<lambda>tag' number. ?R4414 tag' tag' number (?numbera4413 tag' number) (message_info_to_H tag') (?number4413 tag' number tag' (?numbera4413 tag' number)) \<equiv>\<^sup>? \<lambda>tag' number. ?R4410 tag' number (message_info_to_H tag') (?number4410 tag' number)
\<lambda>tag' number. ?R''4410 tag' number (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (?number4410 tag' number) \<equiv>\<^sup>? \<lambda>tag'. ?R''4238 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag'))
\<lambda>tag' number. ?R4410 tag' number (message_info_to_H tag') (?number4410 tag' number) \<equiv>\<^sup>? \<lambda>tag'. ?R4250 (message_info_to_H tag')
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (10 subgoals):
 1. \<And>tag' number rv xfdc. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UnknownSyscallException number; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?Q4419 tag' number rv) (?Q'4419 tag' number rv xfdc) (SKIP # hs) (return (msgLabel (message_info_to_H tag') = 0)) (return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0))
 2. \<And>tag' number. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UnknownSyscallException number\<rbrakk> \<Longrightarrow> \<lbrace>?R4443 tag' tag' number r (message_info_to_H tag') s\<rbrace> do t <- local.getSanitiseRegisterInfo r;
a <- do a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) FaultHandler_H.syscallMessage);
lookupIPCBuffer False s
od;
case a of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) FaultHandler_H.syscallMessage))
od \<lbrace>?Q4419 tag' number\<rbrace>
 3. \<And>tag' number. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UnknownSyscallException number\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4423 tag' tag' number r (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) s) CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4419 tag' number rv (xfdc s)}
 4. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> ?R'4429 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 6. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 7. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and ?R4447 tag x) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 8. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and ?R4447 a x) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 9. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 10. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?R4447 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?R4445 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?R4445 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?R4443 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?R'4429 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) \<equiv>\<^sup>? \<lambda>tag' number. ?R'4425 tag' number (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?R'4425 tag' number (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?R'4423 tag' tag' number r (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (9 subgoals):
 1. \<And>tag' number. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UnknownSyscallException number\<rbrakk> \<Longrightarrow> \<lbrace>?R4443 tag' tag' number r (message_info_to_H tag') s\<rbrace> do t <- local.getSanitiseRegisterInfo r;
a <- do a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) FaultHandler_H.syscallMessage);
lookupIPCBuffer False s
od;
case a of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) FaultHandler_H.syscallMessage))
od \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>tag' number. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UnknownSyscallException number\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4423 tag' tag' number r (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) s) CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>(msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)\<rbrace>}
 3. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> ?R'4429 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 6. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and ?R4447 tag x) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 7. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and ?R4447 a x) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 8. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 9. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?R4447 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?R4445 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?R4445 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?R4443 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?R'4429 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) \<equiv>\<^sup>? \<lambda>tag' number. ?R'4425 tag' number (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?R'4425 tag' number (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?R'4423 tag' tag' number r (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (8 subgoals):
 1. \<And>tag' number. \<lbrakk>r \<noteq> s; f = Fault_H.fault.UnknownSyscallException number\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4423 tag' tag' number r (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) s) CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>(msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)\<rbrace>}
 2. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> ?R'4429 tag tag' ret__unsigneda ret__unsigned x}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 5. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 6. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 7. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 8. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?R'4429 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) \<equiv>\<^sup>? \<lambda>tag' number. ?R'4425 tag' number (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?R'4425 tag' number (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?R'4423 tag' tag' number r (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (7 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned x4. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r tag) (IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  IF fault_to_fault_tag f = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException THEN
  CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)
ELSE
  \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI
FI
FI)
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (7 subgoals):
 1. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r (message_info_to_H tag')) (Cond (if arch_fault_to_fault_tag x4 = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)) (Cond (if arch_fault_to_fault_tag x4 = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)) (Cond (if arch_fault_to_fault_tag x4 = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)) (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (7 subgoals):
 1. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (\<lambda>a. ?R4232 (message_info_to_H tag') a x4) (?R''4236 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r (message_info_to_H tag')) (Cond (if arch_fault_to_fault_tag x4 = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)) (Cond (if arch_fault_to_fault_tag x4 = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)) (Cond (if arch_fault_to_fault_tag x4 = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)) (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R''4236 tag tag' ret__unsigneda ret__unsigned x}}))}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 tag a x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4232 a b x)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (7 subgoals):
 1. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4538 (message_info_to_H tag') x4) (?R'4537 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r (message_info_to_H tag')) (Cond (if arch_fault_to_fault_tag x4 = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Syscall,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)) (Cond (if arch_fault_to_fault_tag x4 = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)) (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R'4537 tag tag' ret__unsigneda ret__unsigned x \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4538 tag x a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4538 a x b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (7 subgoals):
 1. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4538 (message_info_to_H tag') x4) (?R'4541 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r (message_info_to_H tag')) (Cond (if arch_fault_to_fault_tag x4 = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) (CALL copyMRsFaultReply_'proc(tcb_ptr_to_ctcb_ptr s,tcb_ptr_to_ctcb_ptr r,MessageID_Exception,if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage);;
return_C ret__unsigned_long_'_update (\<lambda>s. if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0)) (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R'4541 tag tag' ret__unsigneda ret__unsigned x \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4538 tag x a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4538 a x b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (7 subgoals):
 1. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4538 (message_info_to_H tag') x4) (?R'4544 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r (message_info_to_H tag')) (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R'4544 tag tag' ret__unsigneda ret__unsigned x \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4538 tag x a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4538 a x b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (7 subgoals):
 1. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4538 (message_info_to_H tag') x4) (?R'4544 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r (message_info_to_H tag')) (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
(\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R'4544 tag tag' ret__unsigneda ret__unsigned x \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4538 tag x a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4538 a x b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (7 subgoals):
 1. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?R4538 (message_info_to_H tag') x4) (?R'4544 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag')) x4) (SKIP # hs) (handleArchFaultReply' x4 s r (message_info_to_H tag')) (\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault);;
(\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> ?R'4544 tag tag' ret__unsigneda ret__unsigned x \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4538 tag x a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> ?R4538 a x b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (10 subgoals):
 1. \<And>tag' x4 sa. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> {s'. (\<exists>t. ko_at' t r sa \<and> tcbFault t = Some f) \<and> (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) ({s'. (sa, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = fault_to_fault_tag f\<rbrace>)
 2. \<And>tag' x4 rv' t t'. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_') (?y'4548 tag' x4 rv')
 3. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?P4551 (message_info_to_H tag') x4) (?Q4548 tag' x4) (SKIP # hs) (handleArchFaultReply' x4 s r (message_info_to_H tag')) (?y'4548 tag' x4 (fault_to_fault_tag f))
 4. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag f) ret__unsigned_' (\<lambda>rv rv'. ?Q4548 tag' x4)
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 6. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 7. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (?P4551 tag x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 8. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (?P4551 a x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 9. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 10. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (10 subgoals):
 1. \<And>x4 sa x t ta. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4; cfault_rel (Some (Fault_H.fault.ArchFault x4)) (seL4_Fault_lift (fault_' x)) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))); (sa, x) \<in> rf_sr; ko_at' t r sa; tcbFault t = Some (Fault_H.fault.ArchFault x4); ret__unsigned_' ta = seL4_Fault_get_tag (fault_' x)\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (fault_' x) = arch_fault_to_fault_tag x4
 2. \<And>tag' x4 rv' t t'. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_') (?y'4548 tag' x4 rv')
 3. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?P4551 (message_info_to_H tag') x4) (?Q4548 tag' x4) (SKIP # hs) (handleArchFaultReply' x4 s r (message_info_to_H tag')) (?y'4548 tag' x4 (fault_to_fault_tag f))
 4. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag f) ret__unsigned_' (\<lambda>rv rv'. ?Q4548 tag' x4)
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 6. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 7. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (?P4551 tag x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 8. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (?P4551 a x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 9. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 10. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (10 subgoals):
 1. \<And>x4 sa x t ta ko'. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4; cfault_rel (Some (Fault_H.fault.ArchFault x4)) (seL4_Fault_lift (fault_' x)) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))); ko_at' t r sa; tcbFault t = Some (Fault_H.fault.ArchFault x4); ret__unsigned_' ta = seL4_Fault_get_tag (fault_' x); cslift x (tcb_ptr_to_ctcb_ptr r) = Some ko'; ctcb_relation t ko'\<rbrakk> \<Longrightarrow> seL4_Fault_get_tag (fault_' x) = arch_fault_to_fault_tag x4
 2. \<And>tag' x4 rv' t t'. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_') (?y'4548 tag' x4 rv')
 3. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?P4551 (message_info_to_H tag') x4) (?Q4548 tag' x4) (SKIP # hs) (handleArchFaultReply' x4 s r (message_info_to_H tag')) (?y'4548 tag' x4 (fault_to_fault_tag f))
 4. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag f) ret__unsigned_' (\<lambda>rv rv'. ?Q4548 tag' x4)
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 6. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 7. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (?P4551 tag x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 8. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (?P4551 a x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 9. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 10. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (9 subgoals):
 1. \<And>tag' x4 rv' t t'. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_') (?y'4548 tag' x4 rv')
 2. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?P4551 (message_info_to_H tag') x4) (?Q4548 tag' x4) (SKIP # hs) (handleArchFaultReply' x4 s r (message_info_to_H tag')) (?y'4548 tag' x4 (fault_to_fault_tag f))
 3. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag f) ret__unsigned_' (\<lambda>rv rv'. ?Q4548 tag' x4)
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 6. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (?P4551 tag x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 7. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (?P4551 a x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 8. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 9. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (8 subgoals):
 1. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?P4551 (message_info_to_H tag') x4) (?Q4548 tag' x4) (SKIP # hs) (handleArchFaultReply' x4 s r (message_info_to_H tag')) (\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,fault_to_fault_tag f);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag f) ret__unsigned_' (\<lambda>rv rv'. ?Q4548 tag' x4)
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 5. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (?P4551 tag x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 6. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (?P4551 a x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 7. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 8. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (8 subgoals):
 1. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?P4551 (message_info_to_H tag') x4) (?Q4548 tag' x4) (SKIP # hs) (handleArchFaultReply' x4 s r (message_info_to_H tag') >>= return) (\<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,fault_to_fault_tag f);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag f) ret__unsigned_' (\<lambda>rv rv'. ?Q4548 tag' x4)
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 5. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (?P4551 tag x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 6. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (?P4551 a x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 7. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 8. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (10 subgoals):
 1. \<And>tag' x4 rv ret__unsigned_long. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4; rv = to_bool ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_long_' (?Q6038 tag' x4 rv) (?Q'6038 tag' x4 rv ret__unsigned_long) (SKIP # hs) (return rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<lbrace>?R6041 (message_info_to_H tag') x4\<rbrace> handleArchFaultReply' x4 s r (message_info_to_H tag') \<lbrace>?Q6038 tag' x4\<rbrace>
 3. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6038 tag' x4) \<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,fault_to_fault_tag f) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?Q'6038 tag' x4 rv (ret__unsigned_long_' s)}
 4. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag f) ret__unsigned_' (\<lambda>rv rv'. {sa. faultType_'_update (\<lambda>_. fault_to_fault_tag f) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr r) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>faultType = fault_to_fault_tag (?f6045 (message_info_to_H tag') x4)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> ?R'6038 tag' x4)
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 6. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 7. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (?f6045 tag x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and ?R6041 tag x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 8. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (?f6045 a x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and ?R6041 a x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 9. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 10. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (12 subgoals):
 1. \<And>tag' x4 rv ret__unsigned_long sa fa. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4; rv = to_bool ret__unsigned_long\<rbrakk> \<Longrightarrow> ret__unsigned_long_' (global_exn_var_'_update fa (sa\<lparr>ret__unsigned_long_' := ret__unsigned_long\<rparr>)) = ret__unsigned_long
 2. \<And>tag' x4 rv ret__unsigned_long sa fa. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4; rv = to_bool ret__unsigned_long\<rbrakk> \<Longrightarrow> globals (ret__unsigned_long_'_update fa sa) = globals sa
 3. \<And>tag' x4 rv ret__unsigned_long. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4; rv = to_bool ret__unsigned_long\<rbrakk> \<Longrightarrow> wfhandlers (SKIP # hs)
 4. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<lbrace>?R6041 (message_info_to_H tag') x4\<rbrace> handleArchFaultReply' x4 s r (message_info_to_H tag') \<lbrace>\<lambda>a b. True\<rbrace>
 5. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6038 tag' x4) \<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,fault_to_fault_tag f) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> \<lbrace>rv = to_bool \<^bsup>s\<^esup>ret__unsigned_long\<rbrace>}
 6. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag f) ret__unsigned_' (\<lambda>rv rv'. {sa. faultType_'_update (\<lambda>_. fault_to_fault_tag f) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr r) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>faultType = fault_to_fault_tag (?f6045 (message_info_to_H tag') x4)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> ?R'6038 tag' x4)
 7. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 8. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 9. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (?f6045 tag x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and ?R6041 tag x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 10. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (?f6045 a x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and ?R6041 a x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (9 subgoals):
 1. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<lbrace>?R6041 (message_info_to_H tag') x4\<rbrace> handleArchFaultReply' x4 s r (message_info_to_H tag') \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6038 tag' x4) \<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,fault_to_fault_tag f) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> \<lbrace>rv = to_bool \<^bsup>s\<^esup>ret__unsigned_long\<rbrace>}
 3. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag f) ret__unsigned_' (\<lambda>rv rv'. {sa. faultType_'_update (\<lambda>_. fault_to_fault_tag f) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr r) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>faultType = fault_to_fault_tag (?f6045 (message_info_to_H tag') x4)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> ?R'6038 tag' x4)
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 5. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 6. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (?f6045 tag x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and ?R6041 tag x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 7. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (?f6045 a x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and ?R6041 a x and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 8. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 9. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (8 subgoals):
 1. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6038 tag' x4) \<acute>ret__unsigned_long :== CALL Arch_handleFaultReply_'proc(tcb_ptr_to_ctcb_ptr r,tcb_ptr_to_ctcb_ptr s,fault_to_fault_tag f) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> \<lbrace>rv = to_bool \<^bsup>s\<^esup>ret__unsigned_long\<rbrace>}
 2. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag f) ret__unsigned_' (\<lambda>rv rv'. {sa. faultType_'_update (\<lambda>_. fault_to_fault_tag f) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr r) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>faultType = fault_to_fault_tag (?f6045 (message_info_to_H tag') x4)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> ?R'6038 tag' x4)
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 4. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 5. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (?f6045 tag x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 6. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (?f6045 a x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 7. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 8. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (7 subgoals):
 1. \<And>tag' x4. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = fault_to_fault_tag f) ret__unsigned_' (\<lambda>rv rv'. {sa. faultType_'_update (\<lambda>_. fault_to_fault_tag f) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr r) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>faultType = fault_to_fault_tag (?f6045 (message_info_to_H tag') x4)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (?f6045 tag x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (?f6045 a x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (7 subgoals):
 1. \<And>tag' x4 sa. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4; ret__unsigned_' sa = arch_fault_to_fault_tag x4\<rbrakk> \<Longrightarrow> sa \<in> (if arch_fault_to_fault_tag x4 = fault_to_fault_tag (?f6045 (message_info_to_H tag') x4) then UNIV else {})
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (?f6045 tag x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (?f6045 a x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (7 subgoals):
 1. \<And>tag' x4 sa. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4; ret__unsigned_' sa = arch_fault_to_fault_tag x4\<rbrakk> \<Longrightarrow> sa \<in> (if arch_fault_to_fault_tag x4 = arch_fault_to_fault_tag (?f6111 tag' x4 sa (message_info_to_H (?tag'6111 tag' x4 sa)) x4) then UNIV else {})
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault (?f6112 tag x) = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault (?f6112 a x) = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag' x4 s. ?f6112 (message_info_to_H tag') x4 \<equiv>\<^sup>? \<lambda>tag' x4 s. ?f6111 tag' x4 s (message_info_to_H (?tag'6111 tag' x4 s)) x4
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (7 subgoals):
 1. \<And>tag' x4 sa. \<lbrakk>r \<noteq> s; f = Fault_H.fault.ArchFault x4; ret__unsigned_' sa = arch_fault_to_fault_tag x4\<rbrakk> \<Longrightarrow> arch_fault_to_fault_tag x4 = arch_fault_to_fault_tag (?f6111 tag' x4 sa (message_info_to_H (?tag'6111 tag' x4 sa)) x4)
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 tag tag' ret__unsigneda ret__unsigned\<^esub> (?P'2310 tag tag' ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {sa. \<forall>rv. ret__unsigned_' sa = fault_to_fault_tag f \<longrightarrow> sa \<in> {sa. \<forall>x. sa \<in> {sa. \<forall>xa. sa \<in> {sa. f = Fault_H.fault.UserException x xa \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Exception, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> s \<in> \<lbrace>True = to_bool (SCAST(32 signed \<rightarrow> 32) true)\<rbrace>}}}} \<inter> ({sa. \<forall>x. sa \<in> {sa. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> sa \<in> {sa. sa\<lparr>sender_' := tcb_ptr_to_ctcb_ptr s, receiver_' := tcb_ptr_to_ctcb_ptr r, id___anonymous_enum_' := MessageID_Syscall, length___unsigned_long_' := if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)))\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0)}}} \<inter> {s. \<forall>x. s \<in> {s. f = Fault_H.fault.ArchFault x \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace> \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<inter> - (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {})}}))}
 3. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 4. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault (?f6112 tag x) = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 5. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault (?f6112 a x) = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 6. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 7. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag' x4 s. ?f6112 (message_info_to_H tag') x4 \<equiv>\<^sup>? \<lambda>tag' x4 s. ?f6111 tag' x4 s (message_info_to_H (?tag'6111 tag' x4 s)) x4
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (6 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag'))\<^esub> (?P'2310 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag'))) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s \<in> (if (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength (message_info_to_H tag')))) then UNIV else {}) \<and> s \<in> (if (msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s \<in> (if (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) then UNIV else {}) \<and> s \<in> (if (msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (fault_' s)) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))}
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 3. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 4. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 5. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 6. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (6 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag'))\<^esub> (?P'2310 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag'))) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s \<in> (if (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength (message_info_to_H tag')))) then UNIV else {}) \<and> s \<in> (if (msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s \<in> (if (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) then UNIV else {}) \<and> s \<in> (if (msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (fault_' s)) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))}
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 3. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 4. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 5. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 6. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (6 subgoals):
 1. \<And>tag'. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2310 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag'))\<^esub> (?P'2310 (message_info_to_H tag') tag' (label_CL (seL4_MessageInfo_lift tag')) (length_CL (seL4_MessageInfo_lift tag'))) \<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>fault) {s. ret__unsigned_' s = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s \<in> (if (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength (message_info_to_H tag')))) then UNIV else {}) \<and> s \<in> (if (msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s \<in> (if (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) then UNIV else {}) \<and> s \<in> (if (msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (fault_' s)) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))}
 2. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) (?P'2310 tag tag' ret__unsigneda ret__unsigned \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 3. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 4. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 5. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 6. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (5 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) ({s. \<forall>t. ret__unsigned_' t = seL4_Fault_get_tag (fault_' s) \<longrightarrow> seL4_Fault_get_tag (fault_' s) = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s\<lparr>ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag))) then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s\<lparr>ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag))) then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (fault_' s)) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s\<lparr>ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))} \<inter> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift \<acute>fault) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>)
 2. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'2302 tag tag' ret__unsigneda ret__unsigned \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 3. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 4. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa\<lparr>length___unsigned_long_' := va\<rparr> \<in> ?C'2302 rv (tag_' s) v va \<inter> \<lbrace>True\<rbrace>}}}}}
 5. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (4 subgoals):
 1. \<And>tag tag' ret__unsigneda ret__unsigned sa. \<lbrakk>r \<noteq> s; tag = message_info_to_H tag'; ret__unsigneda = label_CL (seL4_MessageInfo_lift tag'); ret__unsigned = length_CL (seL4_MessageInfo_lift tag'); ((\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 tag x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 tag x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) a)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (\<forall>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength tag))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if ret__unsigned < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then ret__unsigned else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength tag))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel tag = 0) = to_bool (if ret__unsigneda = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))) \<and> cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))} \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 2. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 3. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>length___unsigned_long_' := va\<rparr> \<in> {s. (\<forall>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if va < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then va else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength rv))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel rv = 0) = to_bool (if v = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if va < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then va else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength rv))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel rv = 0) = to_bool (if v = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))) \<and> cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))} \<inter> \<lbrace>True\<rbrace>}}}}}
 4. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (4 subgoals):
 1. \<And>tag' sa t. \<lbrakk>r \<noteq> s; \<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' sa \<and> tcb_at' s sa \<and> tcb_at' r sa \<and> obj_at' (\<lambda>t. tcbFault t = Some (?f4318 (message_info_to_H tag') x xa)) r sa \<and> min (length FaultHandler_H.exceptionMessage) (unat (msgLength (message_info_to_H tag'))) \<le> unat n_exceptionMessage; \<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' sa \<and> tcb_at' s sa \<and> tcb_at' r sa \<and> obj_at' (\<lambda>t. tcbFault t = Some (?f4455 (message_info_to_H tag') x)) r sa \<and> min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag'))) \<le> unat n_syscallMessage; \<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> valid_pspace' sa \<and> tcb_at' s sa \<and> tcb_at' r sa \<and> (\<exists>t. ko_at' t r sa \<and> tcbFault t = Some (Fault_H.fault.ArchFault x)); ko_at' t r sa; tcbFault t = Some f\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. ((\<exists>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength (message_info_to_H tag')))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := arch_fault_to_fault_tag x\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := arch_fault_to_fault_tag x\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := arch_fault_to_fault_tag x\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))) \<and> cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))} \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>fault :== h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])) {s'. (sa, s') \<in> rf_sr}
 2. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 3. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>length___unsigned_long_' := va\<rparr> \<in> {s. (\<forall>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if va < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then va else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength rv))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel rv = 0) = to_bool (if v = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if va < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then va else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength rv))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel rv = 0) = to_bool (if v = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))) \<and> cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))} \<inter> \<lbrace>True\<rbrace>}}}}}
 4. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (4 subgoals):
 1. \<And>tag' sa t. \<lbrakk>r \<noteq> s; \<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' sa \<and> tcb_at' s sa \<and> tcb_at' r sa \<and> obj_at' (\<lambda>t. tcbFault t = Some (?f4318 (message_info_to_H tag') x xa)) r sa \<and> min (length FaultHandler_H.exceptionMessage) (unat (msgLength (message_info_to_H tag'))) \<le> unat n_exceptionMessage; \<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' sa \<and> tcb_at' s sa \<and> tcb_at' r sa \<and> obj_at' (\<lambda>t. tcbFault t = Some (?f4455 (message_info_to_H tag') x)) r sa \<and> min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag'))) \<le> unat n_syscallMessage; \<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> valid_pspace' sa \<and> tcb_at' s sa \<and> tcb_at' r sa \<and> (\<exists>t. ko_at' t r sa \<and> tcbFault t = Some (Fault_H.fault.ArchFault x)); ko_at' t r sa; tcbFault t = Some f\<rbrakk> \<Longrightarrow> {s. ((\<exists>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength (message_info_to_H tag')))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H tag')))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel (message_info_to_H tag') = 0) = to_bool (if label_CL (seL4_MessageInfo_lift tag') = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := arch_fault_to_fault_tag x\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := arch_fault_to_fault_tag x\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := arch_fault_to_fault_tag x\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))) \<and> cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> (sa, s) \<in> rf_sr} \<subseteq> {s. (sa, fault_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) s) \<in> rf_sr}
 2. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 3. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>length___unsigned_long_' := va\<rparr> \<in> {s. (\<forall>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if va < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then va else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength rv))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel rv = 0) = to_bool (if v = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if va < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then va else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength rv))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel rv = 0) = to_bool (if v = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))) \<and> cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))} \<inter> \<lbrace>True\<rbrace>}}}}}
 4. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (3 subgoals):
 1. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a. (\<lambda>b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.exceptionMessage) (unat (msgLength a)) \<le> unat n_exceptionMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x xa xb. f = Fault_H.fault.CapFault x xa xb \<longrightarrow> True) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r and K (r \<noteq> s) and K (min (length FaultHandler_H.syscallMessage) (unat (msgLength a)) \<le> unat n_syscallMessage) and (\<lambda>a. True)) b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> (valid_pspace' and tcb_at' s and tcb_at' r and K (Fault_H.fault.ArchFault x = Fault_H.fault.ArchFault x) and K (s \<noteq> r) and (\<lambda>a. True) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f)) b)) and (\<lambda>s. \<exists>t. ko_at' t r s \<and> tcbFault t = Some f) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr r))\<rbrace>
 2. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>length___unsigned_long_' := va\<rparr> \<in> {s. (\<forall>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if va < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then va else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength rv))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel rv = 0) = to_bool (if v = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if va < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then va else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength rv))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel rv = 0) = to_bool (if v = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))) \<and> cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))} \<inter> \<lbrace>True\<rbrace>}}}}}
 3. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (3 subgoals):
 1. r \<noteq> s \<Longrightarrow> \<lbrace>?R1168 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)\<rbrace> getMessageInfo s \<lbrace>\<lambda>a b. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' b \<and> tcb_at' s b \<and> tcb_at' r b \<and> obj_at' (\<lambda>t. tcbFault t = Some (?f4318 a x xa)) r b) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' b \<and> tcb_at' s b \<and> tcb_at' r b \<and> obj_at' (\<lambda>t. tcbFault t = Some (?f4455 a x)) r b) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> valid_pspace' b \<and> tcb_at' s b \<and> tcb_at' r b \<and> (\<exists>t. ko_at' t r b \<and> tcbFault t = Some (Fault_H.fault.ArchFault x))) \<and> (\<exists>t. ko_at' t r b \<and> tcbFault t = Some f) \<and> tcb_at' r b\<rbrace>
 2. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>length___unsigned_long_' := va\<rparr> \<in> {s. (\<forall>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if va < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then va else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength rv))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel rv = 0) = to_bool (if v = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if va < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then va else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength rv))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel rv = 0) = to_bool (if v = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))) \<and> cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))} \<inter> \<lbrace>True\<rbrace>}}}}}
 3. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and ?R1168 receiver sender) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f4455 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage)
\<lambda>tag' number. ?f4454 tag' number (message_info_to_H tag') (if length_CL (seL4_MessageInfo_lift tag') < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift tag') else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
\<lambda>tag'. ?f4318 (message_info_to_H tag') \<equiv>\<^sup>? \<lambda>tag' number code. ?f4317 tag' number code (message_info_to_H tag') r s proof (prove)
goal (2 subgoals):
 1. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = label_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>label___unsigned_long_' := v\<rparr> \<in> {sa. \<forall>va. va = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>length___unsigned_long_' := va\<rparr> \<in> {s. (\<forall>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if va < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then va else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength rv))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel rv = 0) = to_bool (if v = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if va < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then va else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength rv))) then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel rv = 0) = to_bool (if v = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s\<lparr>fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag (Fault_H.fault.ArchFault x)\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))) \<and> cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))} \<inter> \<lbrace>True\<rbrace>}}}}}
 2. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and (\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' s a \<and> tcb_at' r a \<and> obj_at' (\<lambda>t. tcbFault t = Some (?f6232 receiver sender x xa)) r a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' s a \<and> tcb_at' r a \<and> obj_at' (\<lambda>t. tcbFault t = Some (?f6231 receiver sender x)) r a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> valid_pspace' a \<and> tcb_at' s a \<and> tcb_at' r a \<and> (\<exists>t. ko_at' t r a \<and> tcbFault t = Some (Fault_H.fault.ArchFault x))) \<and> (\<exists>t. ko_at' t r a \<and> tcbFault t = Some f) \<and> tcb_at' r a)) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>tag'. ?f6231 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>tag' number. ?f4453 tag' tag' number r (message_info_to_H tag') s
?f6232 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>number code. ?f6234 number code r s proof (prove)
goal (2 subgoals):
 1. r \<noteq> s \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1164 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long) {s. ((\<exists>t. ret__unsigned_' t = seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s\<lparr>label___unsigned_long_' := label_CL (seL4_MessageInfo_lift (tag_' s)), length___unsigned_long_' := length_CL (seL4_MessageInfo_lift (tag_' s)), fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if length_CL (seL4_MessageInfo_lift (tag_' s)) < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL (seL4_MessageInfo_lift (tag_' s)) else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength (message_info_to_H (tag_' s))))) then UNIV else {}) \<and> s\<lparr>label___unsigned_long_' := label_CL (seL4_MessageInfo_lift (tag_' s)), length___unsigned_long_' := length_CL (seL4_MessageInfo_lift (tag_' s)), fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel (message_info_to_H (tag_' s)) = 0) = to_bool (if label_CL (seL4_MessageInfo_lift (tag_' s)) = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s\<lparr>label___unsigned_long_' := label_CL (seL4_MessageInfo_lift (tag_' s)), length___unsigned_long_' := length_CL (seL4_MessageInfo_lift (tag_' s)), fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if length_CL (seL4_MessageInfo_lift (tag_' s)) < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL (seL4_MessageInfo_lift (tag_' s)) else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H (tag_' s))))) then UNIV else {}) \<and> s\<lparr>label___unsigned_long_' := label_CL (seL4_MessageInfo_lift (tag_' s)), length___unsigned_long_' := length_CL (seL4_MessageInfo_lift (tag_' s)), fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel (message_info_to_H (tag_' s)) = 0) = to_bool (if label_CL (seL4_MessageInfo_lift (tag_' s)) = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s\<lparr>label___unsigned_long_' := label_CL (seL4_MessageInfo_lift (tag_' s)), length___unsigned_long_' := length_CL (seL4_MessageInfo_lift (tag_' s)), fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := arch_fault_to_fault_tag x\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s\<lparr>label___unsigned_long_' := label_CL (seL4_MessageInfo_lift (tag_' s)), length___unsigned_long_' := length_CL (seL4_MessageInfo_lift (tag_' s)), fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := arch_fault_to_fault_tag x\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s\<lparr>label___unsigned_long_' := label_CL (seL4_MessageInfo_lift (tag_' s)), length___unsigned_long_' := length_CL (seL4_MessageInfo_lift (tag_' s)), fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := arch_fault_to_fault_tag x\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))) \<and> cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))}
 2. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and (\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' s a \<and> tcb_at' r a \<and> obj_at' (\<lambda>t. tcbFault t = Some (?f6232 receiver sender x xa)) r a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' s a \<and> tcb_at' r a \<and> obj_at' (\<lambda>t. tcbFault t = Some (?f6231 receiver sender x)) r a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> valid_pspace' a \<and> tcb_at' s a \<and> tcb_at' r a \<and> (\<exists>t. ko_at' t r a \<and> tcbFault t = Some (Fault_H.fault.ArchFault x))) \<and> (\<exists>t. ko_at' t r a \<and> tcbFault t = Some f) \<and> tcb_at' r a)) sa \<and> s' \<in> UNIV \<inter> ?R'1164 receiver sender
flex-flex pairs:
\<lambda>number. ?f6237 number r s \<equiv>\<^sup>? ?f6231 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)
\<lambda>number code. ?f6234 number code r s \<equiv>\<^sup>? ?f6232 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) proof (prove)
goal (1 subgoal):
 1. \<And>receiver sender sa s'. \<lbrakk>r \<noteq> s; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>t. tcbFault t = Some f) r and (tcb_at' s and tcb_at' r)) sa; s' \<in> \<lbrace>cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem \<acute>t_hrs) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' s and (\<lambda>a. (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> valid_pspace' a \<and> tcb_at' s a \<and> tcb_at' r a \<and> obj_at' (\<lambda>t. tcbFault t = Some (?f6232 receiver sender x xa)) r a) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> valid_pspace' a \<and> tcb_at' s a \<and> tcb_at' r a \<and> obj_at' (\<lambda>t. tcbFault t = Some (?f6231 receiver sender x)) r a) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> valid_pspace' a \<and> tcb_at' s a \<and> tcb_at' r a \<and> (\<exists>t. ko_at' t r a \<and> tcbFault t = Some (Fault_H.fault.ArchFault x))) \<and> (\<exists>t. ko_at' t r a \<and> tcbFault t = Some f) \<and> tcb_at' r a)) sa \<and> s' \<in> UNIV \<inter> {s. \<forall>t ta. seL4_MessageInfo_lift (ret__struct_seL4_MessageInfo_C_' ta) = \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr> \<longrightarrow> (seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(receiver\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> ((\<exists>x xa. f = Fault_H.fault.UserException x xa) \<longrightarrow> s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, tag_' := ret__struct_seL4_MessageInfo_C_' ta, label___unsigned_long_' := label_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, length___unsigned_long_' := length_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(receiver\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if length_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr> < SCAST(32 signed \<rightarrow> 32) n_exceptionMessage then length_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr> else SCAST(32 signed \<rightarrow> 32) n_exceptionMessage) = word_of_nat (min (length FaultHandler_H.exceptionMessage) (unat (msgLength (message_info_to_H (ret__struct_seL4_MessageInfo_C_' ta))))) then UNIV else {}) \<and> s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, tag_' := ret__struct_seL4_MessageInfo_C_' ta, label___unsigned_long_' := label_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, length___unsigned_long_' := length_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(receiver\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel (message_info_to_H (ret__struct_seL4_MessageInfo_C_' ta)) = 0) = to_bool (if label_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr> = 0 then 1 else 0) then UNIV else {})) \<and> ((\<exists>x. f = Fault_H.fault.UnknownSyscallException x) \<longrightarrow> s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, tag_' := ret__struct_seL4_MessageInfo_C_' ta, label___unsigned_long_' := label_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, length___unsigned_long_' := length_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(receiver\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (if length_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr> < SCAST(32 signed \<rightarrow> 32) n_syscallMessage then length_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr> else SCAST(32 signed \<rightarrow> 32) n_syscallMessage) = word_of_nat (min (length FaultHandler_H.syscallMessage) (unat (msgLength (message_info_to_H (ret__struct_seL4_MessageInfo_C_' ta))))) then UNIV else {}) \<and> s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, tag_' := ret__struct_seL4_MessageInfo_C_' ta, label___unsigned_long_' := label_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, length___unsigned_long_' := length_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(receiver\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := fault_to_fault_tag f\<rparr> \<in> (if (msgLabel (message_info_to_H (ret__struct_seL4_MessageInfo_C_' ta)) = 0) = to_bool (if label_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr> = 0 then 1 else 0) then UNIV else {})) \<and> (\<forall>x. f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(receiver\<rightarrow>[''tcbLookupFailure_C''])))) \<and> s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, tag_' := ret__struct_seL4_MessageInfo_C_' ta, label___unsigned_long_' := label_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, length___unsigned_long_' := length_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(receiver\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := arch_fault_to_fault_tag x\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException then UNIV else {}) \<and> s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, tag_' := ret__struct_seL4_MessageInfo_C_' ta, label___unsigned_long_' := label_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, length___unsigned_long_' := length_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(receiver\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := arch_fault_to_fault_tag x\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall then UNIV else {}) \<and> s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t, tag_' := ret__struct_seL4_MessageInfo_C_' ta, label___unsigned_long_' := label_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, length___unsigned_long_' := length_CL \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if msgMaxLength < v then msgMaxLength else v\<rparr>, fault_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(receiver\<rightarrow>[''tcbFault_C''])), ret__unsigned_' := arch_fault_to_fault_tag x\<rparr> \<notin> (if arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault then UNIV else {}))) \<and> cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(seL4_Fault_C) &(receiver\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(lookup_fault_C) &(receiver\<rightarrow>[''tcbLookupFailure_C'']))))}
flex-flex pairs:
\<lambda>number. ?f6237 number r s \<equiv>\<^sup>? ?f6231 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)
\<lambda>number code. ?f6234 number code r s \<equiv>\<^sup>? ?f6232 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) proof (prove)
goal (1 subgoal):
 1. \<And>sa s' ko koa obja objb. \<lbrakk>r \<noteq> s; (sa, s') \<in> rf_sr; cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))); valid_pspace' sa; ksPSpace sa s = Some koa; ksPSpace sa r = Some ko; is_aligned r (objBitsKO ko); is_aligned s (objBitsKO koa); fst (projectKO ko sa) = {(objb, sa)}; ps_clear s (objBitsKO koa) sa; fst (projectKO koa sa) = {(obja, sa)}; tcbFault objb = Some f; ps_clear r (objBitsKO ko) sa\<rbrakk> \<Longrightarrow> (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> Fault_H.fault.UserException x xa = ?f6232 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) x xa) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> Fault_H.fault.UnknownSyscallException x = ?f6231 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) x) \<and> (\<forall>t. ((ret__unsigned_long_' t >> 12) && 0xFFFFF = 0 \<longrightarrow> (\<exists>ta. seL4_MessageInfo_lift (ret__struct_seL4_MessageInfo_C_' ta) = \<lparr>label_CL = 0, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if unat msgMaxLength < unat v then msgMaxLength else v\<rparr>) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> (\<forall>x. (arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> f \<noteq> Fault_H.fault.ArchFault x) \<and> (arch_fault_to_fault_tag x \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> (arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> f \<noteq> Fault_H.fault.ArchFault x) \<and> (arch_fault_to_fault_tag x \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> f \<noteq> Fault_H.fault.ArchFault x) \<and> (arch_fault_to_fault_tag x \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))))))) \<and> ((ret__unsigned_long_' t >> 12) && 0xFFFFF \<noteq> 0 \<longrightarrow> (\<exists>ta. seL4_MessageInfo_lift (ret__struct_seL4_MessageInfo_C_' ta) = \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if unat msgMaxLength < unat v then msgMaxLength else v\<rparr>) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> (\<forall>x. (arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> f \<noteq> Fault_H.fault.ArchFault x) \<and> (arch_fault_to_fault_tag x \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> (arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> f \<noteq> Fault_H.fault.ArchFault x) \<and> (arch_fault_to_fault_tag x \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> f \<noteq> Fault_H.fault.ArchFault x) \<and> (arch_fault_to_fault_tag x \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))))))))
flex-flex pairs:
\<lambda>number. ?f6237 number r s \<equiv>\<^sup>? ?f6231 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)
\<lambda>number code. ?f6234 number code r s \<equiv>\<^sup>? ?f6232 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) proof (prove)
using this:
arch_fault_to_fault_tag ?x \<in> {5}

goal (1 subgoal):
 1. \<And>sa s' ko koa obja objb. \<lbrakk>r \<noteq> s; (sa, s') \<in> rf_sr; cfault_rel (Some f) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C''])))); valid_pspace' sa; ksPSpace sa s = Some koa; ksPSpace sa r = Some ko; is_aligned r (objBitsKO ko); is_aligned s (objBitsKO koa); fst (projectKO ko sa) = {(objb, sa)}; ps_clear s (objBitsKO koa) sa; fst (projectKO koa sa) = {(obja, sa)}; tcbFault objb = Some f; ps_clear r (objBitsKO ko) sa\<rbrakk> \<Longrightarrow> (\<forall>x xa. f = Fault_H.fault.UserException x xa \<longrightarrow> Fault_H.fault.UserException x xa = ?f6232 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) x xa) \<and> (\<forall>x. f = Fault_H.fault.UnknownSyscallException x \<longrightarrow> Fault_H.fault.UnknownSyscallException x = ?f6231 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) x) \<and> (\<forall>t. ((ret__unsigned_long_' t >> 12) && 0xFFFFF = 0 \<longrightarrow> (\<exists>ta. seL4_MessageInfo_lift (ret__struct_seL4_MessageInfo_C_' ta) = \<lparr>label_CL = 0, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if unat msgMaxLength < unat v then msgMaxLength else v\<rparr>) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> (\<forall>x. (arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> f \<noteq> Fault_H.fault.ArchFault x) \<and> (arch_fault_to_fault_tag x \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> (arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> f \<noteq> Fault_H.fault.ArchFault x) \<and> (arch_fault_to_fault_tag x \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> f \<noteq> Fault_H.fault.ArchFault x) \<and> (arch_fault_to_fault_tag x \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))))))) \<and> ((ret__unsigned_long_' t >> 12) && 0xFFFFF \<noteq> 0 \<longrightarrow> (\<exists>ta. seL4_MessageInfo_lift (ret__struct_seL4_MessageInfo_C_' ta) = \<lparr>label_CL = (ret__unsigned_long_' t >> 12) && 0xFFFFF, capsUnwrapped_CL = (ret__unsigned_long_' t >> 9) && 7, extraCaps_CL = (ret__unsigned_long_' t >> 7) && 3, length_CL = let v = ret__unsigned_long_' t && 0x7F in if unat msgMaxLength < unat v then msgMaxLength else v\<rparr>) \<longrightarrow> seL4_Fault_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C'']))) = fault_to_fault_tag f \<longrightarrow> (\<forall>x. (arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> f \<noteq> Fault_H.fault.ArchFault x) \<and> (arch_fault_to_fault_tag x \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> (arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> f \<noteq> Fault_H.fault.ArchFault x) \<and> (arch_fault_to_fault_tag x \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (arch_fault_to_fault_tag x = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> f \<noteq> Fault_H.fault.ArchFault x) \<and> (arch_fault_to_fault_tag x \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> f = Fault_H.fault.ArchFault x \<longrightarrow> cfault_rel (Some (Fault_H.fault.ArchFault x)) (seL4_Fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbFault_C''])))) (lookup_fault_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr r\<rightarrow>[''tcbLookupFailure_C'']))))))))))
flex-flex pairs:
\<lambda>number. ?f6237 number r s \<equiv>\<^sup>? ?f6231 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s)
\<lambda>number code. ?f6234 number code r s \<equiv>\<^sup>? ?f6232 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) proof (prove)
goal:
No subgoals!