theory ADT_IF_Refine_C

lemma handleEvent_ccorres:
  notes K_def[simp del]
  shows
  "ccorres (\<lambda>rv rv'. (rv = Inr ()) = (rv' = scast EXCEPTION_NONE)) ret__unsigned_long_'
           (invs' and arch_extras and
                (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and
               (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread))
           (UNIV) []
           (handleEvent e) (callKernel_C_body_if e)" supply option.case_cong[cong] apply (rule_tac r'="K dc \<currency> dc" and xf'="liftxf errstate id (K ()) ret__unsigned_long_'"
        in ccorres_rel_imp[rotated]) apply (case_tac x, simp_all)[1] apply (rule ccorres_guard_imp2) apply (simp add: handleEvent_def callKernel_C_body_if_def) apply (wpc, simp_all)[1] apply (wpc; simp add: handleSyscall_C_body_if_def syscall_from_H_def
                  ; simp add: syscall_defs liftE_def ccorres_cond_univ_iff ccorres_cond_empty_iff)
               \<comment> \<open>SysCall\<close> apply (simp add: handleCall_def) apply (ctac (no_vcg) add: handleInvocation_ccorres')
              \<comment> \<open>SysReplyRecv\<close> apply (simp add: bind_assoc) apply (rule ccorres_rhs_assoc)+ apply (ctac (no_vcg) add: handleReply_ccorres) apply (ctac (no_vcg) add: handleRecv_ccorres) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp[1] apply clarsimp apply wp apply (rule_tac Q="\<lambda>rv s. ct_in_state' simple' s \<and> sch_act_sane s \<and>
                                 (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))"
                    in hoare_post_imp) apply (simp add: ct_in_state'_def) apply (wp handleReply_sane handleReply_ct_not_ksQ)
             \<comment> \<open>SysSend\<close> apply (simp add: handleSend_def) apply (ctac (no_vcg) add: handleInvocation_ccorres)
            \<comment> \<open>SysNBSend\<close> apply (simp add: handleSend_def) apply (ctac (no_vcg) add: handleInvocation_ccorres)
           \<comment> \<open>SysRecv\<close> apply (ctac (no_vcg) add: handleRecv_ccorres) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp
          \<comment> \<open>SysReply\<close> apply (ctac (no_vcg) add: handleReply_ccorres) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp
         \<comment> \<open>SysYield\<close> apply (ctac (no_vcg) add: handleYield_ccorres) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp
        \<comment> \<open>SysNBRecv\<close> apply (ctac (no_vcg) add: handleRecv_ccorres) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp
       \<comment> \<open>UnknownSyscall\<close> apply (simp add: liftE_def bind_assoc handleUnknownSyscall_C_body_if_def) apply (rule ccorres_pre_getCurThread) apply (rule ccorres_symb_exec_r) apply (ctac (no_vcg) add: handleFault_ccorres) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp apply (clarsimp, vcg) apply (clarsimp, rule conseqPre, vcg, clarsimp)
      \<comment> \<open>UserLevelFault\<close> apply (simp add: liftE_def bind_assoc handleUserLevelFault_C_body_if_def) apply (rule ccorres_pre_getCurThread) apply (rule ccorres_symb_exec_r) apply (ctac (no_vcg) add: handleFault_ccorres) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp apply (clarsimp, vcg) apply (clarsimp, rule conseqPre, vcg, clarsimp)
     \<comment> \<open>Interrupt\<close> apply (ctac add: handleInterrupt_if_ccorres[unfolded handleEvent_def, simplified])
    \<comment> \<open>VMFaultEvent\<close> apply (simp add: liftE_def bind_assoc handleVMFaultEvent_C_body_if_def) apply (rule ccorres_pre_getCurThread) apply (simp add: catch_def) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow_novcg) apply (rule ccorres_split_nothrow_case_sum) apply (ctac (no_vcg) add: handleVMFault_ccorres) apply ceqv apply clarsimp apply clarsimp apply (rule ccorres_cond_univ) apply (rule_tac P="\<lambda>s. thread = ksCurThread s" in ccorres_cross_over_guard) apply (rule_tac xf'=xfdc in ccorres_call) apply (ctac (no_vcg) add: handleFault_ccorres) apply simp apply simp apply simp apply (wp hv_inv_ex') apply (simp add: guard_is_UNIV_def) apply (vcg exspec=handleVMFault_modifies) apply ceqv apply clarsimp apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp apply (simp add: guard_is_UNIV_def) apply (auto simp: ct_in_state'_def ct_not_ksQ isReply_def is_cap_fault_def
                     cfault_rel_def seL4_Fault_UnknownSyscall_lift seL4_Fault_UserException_lift
               elim: pred_tcb'_weakenE st_tcb_ex_cap''
               dest: st_tcb_at_idle_thread' rf_sr_ksCurThread)
  \<comment> \<open>HypervisorEvent\<close> apply (simp add: liftE_def bind_assoc) apply (rule ccorres_guard_imp2) apply (rule ccorres_symb_exec_l) apply (case_tac x6; simp add: handleHypervisorFault_def) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp+ apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>rv rv'. (rv = Inr ()) = (rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) ret__unsigned_long_' (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) UNIV [] (handleEvent e) (callKernel_C_body_if e) proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>rv rv'. (rv = Inr ()) = (rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) ret__unsigned_long_' (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) UNIV [] (handleEvent e) (callKernel_C_body_if e) proof (prove)
goal (2 subgoals):
 1. \<And>x y. (K dc \<currency> dc) x (liftxf errstate id (K ()) ret__unsigned_long_' y) \<Longrightarrow> (x = Inr ()) = (ret__unsigned_long_' y = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) UNIV [] (handleEvent e) (callKernel_C_body_if e) proof (prove)
goal (1 subgoal):
 1. ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) UNIV [] (handleEvent e) (callKernel_C_body_if e) proof (prove)
goal (2 subgoals):
 1. ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?Q6 ?Q'6 [] (handleEvent e) (callKernel_C_body_if e)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q6 s \<and> s' \<in> ?Q'6 proof (prove)
goal (2 subgoals):
 1. ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?Q6 ?Q'6 [] (case e of SyscallEvent syscall.SysCall \<Rightarrow> handleCall | SyscallEvent syscall.SysReplyRecv \<Rightarrow> withoutPreemption $ do handleReply;
handleRecv True
od | SyscallEvent syscall.SysSend \<Rightarrow> handleSend True | SyscallEvent syscall.SysNBSend \<Rightarrow> handleSend False | SyscallEvent syscall.SysRecv \<Rightarrow> withoutPreemption $ handleRecv True | SyscallEvent syscall.SysReply \<Rightarrow> withoutPreemption handleReply | SyscallEvent syscall.SysYield \<Rightarrow> withoutPreemption handleYield | SyscallEvent syscall.SysNBRecv \<Rightarrow> withoutPreemption $ handleRecv False | UnknownSyscall n \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
handleFault thread $ Fault_H.fault.UnknownSyscallException $ fromIntegral n;
return ()
od | UserLevelFault w1 w2 \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
handleFault thread $ Fault_H.fault.UserException (w1 && mask 32) (w2 && mask 28);
return ()
od | Interrupt \<Rightarrow> withoutPreemption $ do active <- doMachineOp (getActiveIRQ False);
case active of None \<Rightarrow> doMachineOp $ debugPrint [] | Some irq \<Rightarrow> handleInterrupt irq
od | VMFaultEvent faultType \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
handleVMFault thread faultType `~catchFailure~` handleFault thread;
return ()
od | HypervisorEvent hypType \<Rightarrow> withoutPreemption $ do thread <- getCurThread;
handleHypervisorFault thread hypType
od) (case e of SyscallEvent n \<Rightarrow> handleSyscall_C_body_if (UCAST(32 \<rightarrow> 32 signed) (syscall_from_H n)) | UnknownSyscall n \<Rightarrow> handleUnknownSyscall_C_body_if (word_of_nat n) | UserLevelFault w1 w2 \<Rightarrow> handleUserLevelFault_C_body_if w1 w2 | Interrupt \<Rightarrow> handleInterruptEntry_C_body_if | VMFaultEvent t \<Rightarrow> handleVMFaultEvent_C_body_if (vm_fault_type_from_H t) | HypervisorEvent t \<Rightarrow> SKIP;;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q6 s \<and> s' \<in> ?Q'6 proof (prove)
goal (7 subgoals):
 1. \<And>x1. e = SyscallEvent x1 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R35 x1) (?R''41 x1) [] (case x1 of syscall.SysCall \<Rightarrow> handleCall | syscall.SysReplyRecv \<Rightarrow> withoutPreemption $ do handleReply;
handleRecv True
od | syscall.SysSend \<Rightarrow> handleSend True | syscall.SysNBSend \<Rightarrow> handleSend False | syscall.SysRecv \<Rightarrow> withoutPreemption $ handleRecv True | syscall.SysReply \<Rightarrow> withoutPreemption handleReply | syscall.SysYield \<Rightarrow> withoutPreemption handleYield | syscall.SysNBRecv \<Rightarrow> withoutPreemption $ handleRecv False) (handleSyscall_C_body_if (UCAST(32 \<rightarrow> 32 signed) (syscall_from_H x1)))
 2. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 3. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 4. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 5. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 6. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> ?R35 x s) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> ?R''41 x}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (14 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysCall; x1 = syscall.SysCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R77 syscall.SysCall) (?R''77 syscall.SysCall) [] handleCall (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true))
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R76 syscall.SysReplyRecv) (?R''76 syscall.SysReplyRecv) [] (do r <- do y <- handleReply;
handleRecv True
od;
return (Inr ())
od) (CALL handleReply_'proc();;
CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 10. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysCall; x1 = syscall.SysCall\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R77 syscall.SysCall) (?R''77 syscall.SysCall) [] (handleInvocation True True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true))
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R76 syscall.SysReplyRecv) (?R''76 syscall.SysReplyRecv) [] (do r <- do y <- handleReply;
handleRecv True
od;
return (Inr ())
od) (CALL handleReply_'proc();;
CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 10. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R76 syscall.SysReplyRecv) (?R''76 syscall.SysReplyRecv) [] (do r <- do y <- handleReply;
handleRecv True
od;
return (Inr ())
od) (CALL handleReply_'proc();;
CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 9. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 10. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R76 syscall.SysReplyRecv) (?R''76 syscall.SysReplyRecv) [] (do y <- handleReply;
r <- handleRecv True;
return (Inr ())
od) (CALL handleReply_'proc();;
CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 9. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 10. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R76 syscall.SysReplyRecv) (?R''76 syscall.SysReplyRecv) [] (do y <- handleReply;
r <- handleRecv True;
return (Inr ())
od) (CALL handleReply_'proc();;
(CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 9. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 10. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x1 rv xfdc. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q280 x1 rv) (?Q'294 rv xfdc) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R288 syscall.SysReplyRecv\<rbrace> handleReply \<lbrace>?Q280 x1\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 10. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>t rv. ?Q'294 rv (xfdc t) \<equiv>\<^sup>? ?Q'293 syscall.SysReplyRecv proof (prove)
goal (15 subgoals):
 1. \<And>x1 rv xfdca rva xfdc. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q325 x1 rv xfdca rva) (?Q'343 rv xfdca rva xfdc) [] (return (Inr ())) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x1 rv xfdc. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R338 x1 rv\<rbrace> handleRecv True \<lbrace>?Q325 x1 rv xfdc\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R288 syscall.SysReplyRecv\<rbrace> handleReply \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and ?R338 x1 a\<rbrace>
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 10. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
A total of 15 subgoals...
flex-flex pairs:
?Q'344 syscall.SysReplyRecv \<equiv>\<^sup>? \<lambda>t rv ta rva. ?Q'343 rv (xfdc t) rva (xfdc ta) proof (prove)
goal (15 subgoals):
 1. \<And>x1 rv xfdca rva xfdc. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>x1 rv xfdc. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R338 x1 rv\<rbrace> handleRecv True \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R288 syscall.SysReplyRecv\<rbrace> handleReply \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and ?R338 x1 a\<rbrace>
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 10. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x1 rv xfdca rva xfdc \<sigma>. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>))}
 2. \<And>x1 rv xfdc. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R338 x1 rv\<rbrace> handleRecv True \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R288 syscall.SysReplyRecv\<rbrace> handleReply \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and ?R338 x1 a\<rbrace>
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 10. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x1 rv xfdc. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R338 x1 rv\<rbrace> handleRecv True \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R288 syscall.SysReplyRecv\<rbrace> handleReply \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and ?R338 x1 a\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 10. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; x1 = syscall.SysReplyRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R288 syscall.SysReplyRecv\<rbrace> handleReply \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)\<rbrace>
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 9. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 10. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. e = SyscallEvent syscall.SysReplyRecv \<Longrightarrow> \<lbrace>?R288 syscall.SysReplyRecv\<rbrace> handleReply \<lbrace>\<lambda>a b. invs' b \<and> st_tcb_at' simple' (ksCurThread b) b \<and> sch_act_sane b \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba)))\<rbrace>
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 9. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 10. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. e = SyscallEvent syscall.SysReplyRecv \<Longrightarrow> \<lbrace>?P'392 (ds_id syscall.SysReplyRecv)\<rbrace> handleReply \<lbrace>\<lambda>rv s. st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))\<rbrace>
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 9. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 10. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv s. \<lbrakk>e = SyscallEvent syscall.SysReplyRecv; ct_in_state' simple' s \<and> sch_act_sane s \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))\<rbrakk> \<Longrightarrow> st_tcb_at' simple' (ksCurThread s) s \<and> sch_act_sane s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)))
 2. e = SyscallEvent syscall.SysReplyRecv \<Longrightarrow> \<lbrace>?P'392 (ds_id syscall.SysReplyRecv)\<rbrace> handleReply \<lbrace>\<lambda>rv s. ct_in_state' simple' s \<and> sch_act_sane s \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 10. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. e = SyscallEvent syscall.SysReplyRecv \<Longrightarrow> \<lbrace>?P'392 (ds_id syscall.SysReplyRecv)\<rbrace> handleReply \<lbrace>\<lambda>rv s. ct_in_state' simple' s \<and> sch_act_sane s \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))\<rbrace>
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 9. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 10. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleSend True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 8. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 9. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 10. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysSend; x1 = syscall.SysSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R75 syscall.SysSend) (?R''75 syscall.SysSend) [] (handleInvocation False True) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) true))
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 8. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 9. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 10. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleSend False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 7. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 8. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 9. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 10. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBSend; x1 = syscall.SysNBSend\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R74 syscall.SysNBSend) (?R''74 syscall.SysNBSend) [] (handleInvocation False False) (\<acute>ret__unsigned_long :== CALL handleInvocation_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false))
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 7. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 8. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 9. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 10. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R73 syscall.SysRecv) (?R''73 syscall.SysRecv) [] (do r <- handleRecv True;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) true);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 6. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 7. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 8. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 9. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ?R73 x s) \<and> (x = syscall.SysReply \<longrightarrow> ?R72 x s) \<and> (x = syscall.SysYield \<longrightarrow> ?R71 x s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ?R70 x s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> ?R''73 x} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> ?R''72 x} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> ?R''71 x} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> ?R''70 x}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (11 subgoals):
 1. \<And>x1 rv xfdc. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q438 x1 rv) (?Q'452 rv xfdc) [] (return (Inr ())) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R446 syscall.SysRecv\<rbrace> handleRecv True \<lbrace>?Q438 x1\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 7. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 8. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 9. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 10. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>t rv. ?Q'452 rv (xfdc t) \<equiv>\<^sup>? ?Q'451 syscall.SysRecv proof (prove)
goal (11 subgoals):
 1. \<And>x1 rv xfdc. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv; dc rv xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R446 syscall.SysRecv\<rbrace> handleRecv True \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 7. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 8. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 9. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 10. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x1 rv xfdc \<sigma>. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv; dc rv xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>))}
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R446 syscall.SysRecv\<rbrace> handleRecv True \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 7. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 8. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 9. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 10. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysRecv; x1 = syscall.SysRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R446 syscall.SysRecv\<rbrace> handleRecv True \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 6. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 7. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 8. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 9. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and ?R446 x) s) \<and> (x = syscall.SysReply \<longrightarrow> ?R72 x s) \<and> (x = syscall.SysYield \<longrightarrow> ?R71 x s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ?R70 x s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> ?R''72 x} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> ?R''71 x} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> ?R''70 x}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (9 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R72 syscall.SysReply) (?R''72 syscall.SysReply) [] (do r <- handleReply;
return (Inr ())
od) (CALL handleReply_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 5. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 6. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 7. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 8. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ?R72 x s) \<and> (x = syscall.SysYield \<longrightarrow> ?R71 x s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ?R70 x s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> ?R''72 x} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> ?R''71 x} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> ?R''70 x}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (10 subgoals):
 1. \<And>x1 rv xfdc. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q498 x1 rv) (?Q'512 rv xfdc) [] (return (Inr ())) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> \<lbrace>?R506 syscall.SysReply\<rbrace> handleReply \<lbrace>?Q498 x1\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 6. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 7. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 8. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 9. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and ?R506 x) s) \<and> (x = syscall.SysYield \<longrightarrow> ?R71 x s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ?R70 x s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'511 x t rv}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> ?R''71 x} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> ?R''70 x}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}}))))
flex-flex pairs:
\<lambda>t rv. ?Q'512 rv (xfdc t) \<equiv>\<^sup>? ?Q'511 syscall.SysReply proof (prove)
goal (10 subgoals):
 1. \<And>x1 rv xfdc. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply; dc rv xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> \<lbrace>?R506 syscall.SysReply\<rbrace> handleReply \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 6. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 7. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 8. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 9. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and ?R506 x) s) \<and> (x = syscall.SysYield \<longrightarrow> ?R71 x s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ?R70 x s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> ?R''71 x} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> ?R''70 x}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (10 subgoals):
 1. \<And>x1 rv xfdc \<sigma>. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply; dc rv xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>))}
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> \<lbrace>?R506 syscall.SysReply\<rbrace> handleReply \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 6. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 7. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 8. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 9. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and ?R506 x) s) \<and> (x = syscall.SysYield \<longrightarrow> ?R71 x s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ?R70 x s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> ?R''71 x} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> ?R''70 x}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (9 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysReply; x1 = syscall.SysReply\<rbrakk> \<Longrightarrow> \<lbrace>?R506 syscall.SysReply\<rbrace> handleReply \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 5. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 6. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 7. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 8. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and ?R506 x) s) \<and> (x = syscall.SysYield \<longrightarrow> ?R71 x s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ?R70 x s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> ?R''71 x} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> ?R''70 x}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (8 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R71 syscall.SysYield) (?R''71 syscall.SysYield) [] (do r <- handleYield;
return (Inr ())
od) (CALL handleYield_'proc();;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 4. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 5. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 6. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 7. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> ?R71 x s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ?R70 x s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> ?R''71 x} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> ?R''70 x}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (9 subgoals):
 1. \<And>x1 rv xfdc. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q558 x1 rv) (?Q'572 rv xfdc) [] (return (Inr ())) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> \<lbrace>?R566 syscall.SysYield\<rbrace> handleYield \<lbrace>?Q558 x1\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 5. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 6. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 7. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 8. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and ?R566 x) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ?R70 x s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'571 x t rv}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> ?R''70 x}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}}))))
flex-flex pairs:
\<lambda>t rv. ?Q'572 rv (xfdc t) \<equiv>\<^sup>? ?Q'571 syscall.SysYield proof (prove)
goal (9 subgoals):
 1. \<And>x1 rv xfdc. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield; dc rv xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> \<lbrace>?R566 syscall.SysYield\<rbrace> handleYield \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 5. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 6. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 7. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 8. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and ?R566 x) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ?R70 x s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> ?R''70 x}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (9 subgoals):
 1. \<And>x1 rv xfdc \<sigma>. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield; dc rv xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>))}
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> \<lbrace>?R566 syscall.SysYield\<rbrace> handleYield \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 5. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 6. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 7. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 8. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and ?R566 x) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ?R70 x s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> ?R''70 x}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (8 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysYield; x1 = syscall.SysYield\<rbrakk> \<Longrightarrow> \<lbrace>?R566 syscall.SysYield\<rbrace> handleYield \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 4. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 5. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 6. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 7. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and ?R566 x) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ?R70 x s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> ?R''70 x}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (7 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R70 syscall.SysNBRecv) (?R''70 syscall.SysNBRecv) [] (do r <- handleRecv False;
return (Inr ())
od) (CALL handleRecv_'proc(SCAST(32 signed \<rightarrow> 32) false);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 3. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 4. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 5. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 6. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ?R70 x s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> ?R''70 x}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (8 subgoals):
 1. \<And>x1 rv xfdc. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q618 x1 rv) (?Q'632 rv xfdc) [] (return (Inr ())) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R626 syscall.SysNBRecv\<rbrace> handleRecv False \<lbrace>?Q618 x1\<rbrace>
 3. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 4. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 5. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 6. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 7. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and ?R626 x) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'631 x t rv}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}}))))
flex-flex pairs:
\<lambda>t rv. ?Q'632 rv (xfdc t) \<equiv>\<^sup>? ?Q'631 syscall.SysNBRecv proof (prove)
goal (8 subgoals):
 1. \<And>x1 rv xfdc. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv; dc rv xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R626 syscall.SysNBRecv\<rbrace> handleRecv False \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 4. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 5. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 6. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 7. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and ?R626 x) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (8 subgoals):
 1. \<And>x1 rv xfdc \<sigma>. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv; dc rv xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>))}
 2. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R626 syscall.SysNBRecv\<rbrace> handleRecv False \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 4. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 5. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 6. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 7. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and ?R626 x) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (7 subgoals):
 1. \<And>x1. \<lbrakk>e = SyscallEvent syscall.SysNBRecv; x1 = syscall.SysNBRecv\<rbrakk> \<Longrightarrow> \<lbrace>?R626 syscall.SysNBRecv\<rbrace> handleRecv False \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 3. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 4. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 5. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 6. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and ?R626 x) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (6 subgoals):
 1. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2))
od)) (handleUnknownSyscall_C_body_if (word_of_nat x2))
 2. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 3. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 4. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 5. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (6 subgoals):
 1. \<And>x2. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R36 x2) (?R''42 x2) [] (do thread <- getCurThread;
r <- handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2));
return (Inr ())
od) (\<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 3. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 4. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 5. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> ?R36 x s) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> ?R''42 x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (6 subgoals):
 1. \<And>x2 thread. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P674 x2 thread) (?P'674 x2 thread) [] (do r <- handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2));
return (Inr ())
od) (\<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 3. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 4. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 5. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P674 x rv s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'674 x rv}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (8 subgoals):
 1. \<And>x2 thread. e = UnknownSyscall x2 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P674 x2 thread) (?Q'676 x2 thread) [] (do r <- handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2));
return (Inr ())
od) (CALL handleFault_'proc(\<acute>ksCurThread);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x2 thread. e = UnknownSyscall x2 \<Longrightarrow> \<Gamma>\<turnstile> (?P'674 x2 thread) \<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2) (?Q'676 x2 thread)
 3. \<And>x2 thread s. \<lbrakk>e = UnknownSyscall x2; ?P674 x2 thread s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'674 x2 thread \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2) {s'. (s, s') \<in> rf_sr}
 4. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 5. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 6. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 7. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P674 x rv s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'674 x rv}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (9 subgoals):
 1. \<And>x2 thread rv xfdc. \<lbrakk>e = UnknownSyscall x2; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q682 x2 thread rv) (?Q'682 x2 thread rv xfdc) [] (return (Inr ())) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x2 thread. e = UnknownSyscall x2 \<Longrightarrow> \<lbrace>?R682 x2 thread\<rbrace> handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2)) \<lbrace>?Q682 x2 thread\<rbrace>
 3. \<And>x2 thread. e = UnknownSyscall x2 \<Longrightarrow> \<Gamma>\<turnstile> (?P'674 x2 thread) \<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x2))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'682 x2 thread rv (xfdc t)})
 4. \<And>x2 thread s. \<lbrakk>e = UnknownSyscall x2; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R682 x2 thread) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'674 x2 thread \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2) {s'. (s, s') \<in> rf_sr}
 5. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 6. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 7. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 8. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and ?R682 x rv) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'674 x rv}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (9 subgoals):
 1. \<And>x2 thread rv xfdc. \<lbrakk>e = UnknownSyscall x2; dc rv xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>x2 thread. e = UnknownSyscall x2 \<Longrightarrow> \<lbrace>?R682 x2 thread\<rbrace> handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2)) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>x2 thread. e = UnknownSyscall x2 \<Longrightarrow> \<Gamma>\<turnstile> (?P'674 x2 thread) \<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x2))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>x2 thread s. \<lbrakk>e = UnknownSyscall x2; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R682 x2 thread) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'674 x2 thread \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2) {s'. (s, s') \<in> rf_sr}
 5. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 6. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 7. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 8. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and ?R682 x rv) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'674 x rv}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (9 subgoals):
 1. \<And>x2 thread rv xfdc \<sigma>. \<lbrakk>e = UnknownSyscall x2; dc rv xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>))}
 2. \<And>x2 thread. e = UnknownSyscall x2 \<Longrightarrow> \<lbrace>?R682 x2 thread\<rbrace> handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2)) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>x2 thread. e = UnknownSyscall x2 \<Longrightarrow> \<Gamma>\<turnstile> (?P'674 x2 thread) \<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x2))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>x2 thread s. \<lbrakk>e = UnknownSyscall x2; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R682 x2 thread) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'674 x2 thread \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2) {s'. (s, s') \<in> rf_sr}
 5. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 6. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 7. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 8. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and ?R682 x rv) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'674 x rv}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (8 subgoals):
 1. \<And>x2 thread. e = UnknownSyscall x2 \<Longrightarrow> \<lbrace>?R682 x2 thread\<rbrace> handleFault thread (Fault_H.fault.UnknownSyscallException (word_of_nat x2)) \<lbrace>\<lambda>rv _. True\<rbrace>
 2. \<And>x2 thread. e = UnknownSyscall x2 \<Longrightarrow> \<Gamma>\<turnstile> (?P'674 x2 thread) \<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x2))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 3. \<And>x2 thread s. \<lbrakk>e = UnknownSyscall x2; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R682 x2 thread) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'674 x2 thread \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2) {s'. (s, s') \<in> rf_sr}
 4. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 5. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 6. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 7. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and ?R682 x rv) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'674 x rv}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (7 subgoals):
 1. \<And>x2 thread. e = UnknownSyscall x2 \<Longrightarrow> \<Gamma>\<turnstile> (?P'674 x2 thread) \<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x2))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 2. \<And>x2 thread s. \<lbrakk>e = UnknownSyscall x2; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'674 x2 thread \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2) {s'. (s, s') \<in> rf_sr}
 3. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 4. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 5. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 6. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'674 x rv}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (6 subgoals):
 1. \<And>x2 thread s. \<lbrakk>e = UnknownSyscall x2; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x2 && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x2))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UnknownSyscall_new_'proc(word_of_nat x2) {s'. (s, s') \<in> rf_sr}
 2. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 3. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 4. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 5. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (5 subgoals):
 1. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (liftE (do thread <- getCurThread;
handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28))
od)) (handleUserLevelFault_C_body_if x31 x32)
 2. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 3. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 4. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (5 subgoals):
 1. \<And>x31 x32. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R37 x31 x32) (?R''43 x31 x32) [] (do thread <- getCurThread;
r <- handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28));
return (Inr ())
od) (\<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 3. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 4. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> ?R37 x xa s) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> ?R''43 x xa}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (5 subgoals):
 1. \<And>x31 x32 thread. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P764 x31 x32 thread) (?P'764 x31 x32 thread) [] (do r <- handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28));
return (Inr ())
od) (\<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32);;
(CALL handleFault_'proc(\<acute>ksCurThread);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 3. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 4. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P764 x xa rv s)) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'764 x xa rv}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (7 subgoals):
 1. \<And>x31 x32 thread. e = UserLevelFault x31 x32 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P764 x31 x32 thread) (?Q'766 x31 x32 thread) [] (do r <- handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28));
return (Inr ())
od) (CALL handleFault_'proc(\<acute>ksCurThread);;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x31 x32 thread. e = UserLevelFault x31 x32 \<Longrightarrow> \<Gamma>\<turnstile> (?P'764 x31 x32 thread) \<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32) (?Q'766 x31 x32 thread)
 3. \<And>x31 x32 thread s. \<lbrakk>e = UserLevelFault x31 x32; ?P764 x31 x32 thread s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'764 x31 x32 thread \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32) {s'. (s, s') \<in> rf_sr}
 4. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 5. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 6. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P764 x xa rv s)) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'764 x xa rv}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (8 subgoals):
 1. \<And>x31 x32 thread rv xfdc. \<lbrakk>e = UserLevelFault x31 x32; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q772 x31 x32 thread rv) (?Q'772 x31 x32 thread rv xfdc) [] (return (Inr ())) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x31 x32 thread. e = UserLevelFault x31 x32 \<Longrightarrow> \<lbrace>?R772 x31 x32 thread\<rbrace> handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28)) \<lbrace>?Q772 x31 x32 thread\<rbrace>
 3. \<And>x31 x32 thread. e = UserLevelFault x31 x32 \<Longrightarrow> \<Gamma>\<turnstile> (?P'764 x31 x32 thread) \<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.UserException x31 (x32 && mask 28))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'772 x31 x32 thread rv (xfdc t)})
 4. \<And>x31 x32 thread s. \<lbrakk>e = UserLevelFault x31 x32; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R772 x31 x32 thread) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'764 x31 x32 thread \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32) {s'. (s, s') \<in> rf_sr}
 5. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 6. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 7. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and ?R772 x xa rv) s)) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'764 x xa rv}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (8 subgoals):
 1. \<And>x31 x32 thread rv xfdc. \<lbrakk>e = UserLevelFault x31 x32; dc rv xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>x31 x32 thread. e = UserLevelFault x31 x32 \<Longrightarrow> \<lbrace>?R772 x31 x32 thread\<rbrace> handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28)) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>x31 x32 thread. e = UserLevelFault x31 x32 \<Longrightarrow> \<Gamma>\<turnstile> (?P'764 x31 x32 thread) \<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.UserException x31 (x32 && mask 28))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>x31 x32 thread s. \<lbrakk>e = UserLevelFault x31 x32; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R772 x31 x32 thread) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'764 x31 x32 thread \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32) {s'. (s, s') \<in> rf_sr}
 5. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 6. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 7. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and ?R772 x xa rv) s)) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'764 x xa rv}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (8 subgoals):
 1. \<And>x31 x32 thread rv xfdc \<sigma>. \<lbrakk>e = UserLevelFault x31 x32; dc rv xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>))}
 2. \<And>x31 x32 thread. e = UserLevelFault x31 x32 \<Longrightarrow> \<lbrace>?R772 x31 x32 thread\<rbrace> handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28)) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>x31 x32 thread. e = UserLevelFault x31 x32 \<Longrightarrow> \<Gamma>\<turnstile> (?P'764 x31 x32 thread) \<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.UserException x31 (x32 && mask 28))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>x31 x32 thread s. \<lbrakk>e = UserLevelFault x31 x32; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R772 x31 x32 thread) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'764 x31 x32 thread \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32) {s'. (s, s') \<in> rf_sr}
 5. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 6. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 7. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and ?R772 x xa rv) s)) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'764 x xa rv}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (7 subgoals):
 1. \<And>x31 x32 thread. e = UserLevelFault x31 x32 \<Longrightarrow> \<lbrace>?R772 x31 x32 thread\<rbrace> handleFault thread (Fault_H.fault.UserException x31 (x32 && mask 28)) \<lbrace>\<lambda>rv _. True\<rbrace>
 2. \<And>x31 x32 thread. e = UserLevelFault x31 x32 \<Longrightarrow> \<Gamma>\<turnstile> (?P'764 x31 x32 thread) \<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.UserException x31 (x32 && mask 28))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 3. \<And>x31 x32 thread s. \<lbrakk>e = UserLevelFault x31 x32; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and ?R772 x31 x32 thread) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'764 x31 x32 thread \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32) {s'. (s, s') \<in> rf_sr}
 4. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 5. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 6. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and ?R772 x xa rv) s)) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'764 x xa rv}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (6 subgoals):
 1. \<And>x31 x32 thread. e = UserLevelFault x31 x32 \<Longrightarrow> \<Gamma>\<turnstile> (?P'764 x31 x32 thread) \<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32) ({s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some (Fault_H.fault.UserException x31 (x32 && mask 28))) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 2. \<And>x31 x32 thread s. \<lbrakk>e = UserLevelFault x31 x32; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'764 x31 x32 thread \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32) {s'. (s, s') \<in> rf_sr}
 3. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 4. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 5. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'764 x xa rv}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (5 subgoals):
 1. \<And>x31 x32 thread s. \<lbrakk>e = UserLevelFault x31 x32; (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x31 && mask 32, code_CL = x32 && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x31 (x32 && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>current_fault :== CALL seL4_Fault_UserException_new_'proc(x31,x32) {s'. (s, s') \<in> rf_sr}
 2. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 3. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 4. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (4 subgoals):
 1. e = Interrupt \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?R38 ?R''44 [] (liftE (doMachineOp (getActiveIRQ False) >>= case_option (return ()) handleInterrupt)) handleInterruptEntry_C_body_if
 2. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 3. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> ?R38 s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> ?R''44} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (3 subgoals):
 1. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (liftE (do thread <- getCurThread;
handleVMFault thread x5 <catch> handleFault thread
od)) (handleVMFaultEvent_C_body_if (vm_fault_type_from_H x5))
 2. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (3 subgoals):
 1. \<And>x5. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R39 x5) (?R''45 x5) [] (do thread <- getCurThread;
r <- handleVMFault thread x5 <catch> handleFault thread;
return (Inr ())
od) (\<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL handleFault_'proc(\<acute>ksCurThread)
FI;;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> ?R39 x s) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> ?R''45 x}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (3 subgoals):
 1. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P863 x5 thread) (?P'863 x5 thread) [] (do r <- handleVMFault thread x5 <catch> handleFault thread;
return (Inr ())
od) (\<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL handleFault_'proc(\<acute>ksCurThread)
FI;;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P863 x rv s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'863 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (3 subgoals):
 1. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P863 x5 thread) (?P'863 x5 thread) [] (do r <- do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od;
return (Inr ())
od) (\<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL handleFault_'proc(\<acute>ksCurThread)
FI;;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P863 x rv s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'863 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (3 subgoals):
 1. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P863 x5 thread) (?P'863 x5 thread) [] (do r <- do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od;
return (Inr ())
od) (\<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL handleFault_'proc(\<acute>ksCurThread)
FI;;
\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P863 x rv s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'863 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (7 subgoals):
 1. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> ccorres (?r'872 x5 thread) (?xf'872 x5 thread) (?P872 x5 thread) (?P'863 x5 thread) [] (do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od) (\<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL handleFault_'proc(\<acute>ksCurThread)
FI)
 2. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> (?xf'872 x5 thread) rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 3. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; ?r'872 x5 thread r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 4. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 5. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV (?r'872 x5 thread) (?xf'872 x5 thread) (?Q'872 x5 thread)
 6. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (?P872 x rv and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'863 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (12 subgoals):
 1. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> ccorres (?f'878 x5 thread \<currency> ?r'878 x5 thread) (liftxf (?es878 x5 thread) (?ef'878 x5 thread) (?vf'878 x5 thread) (?xf'878 x5 thread)) (?P878 x5 thread) (?P'878 x5 thread) [] (handleVMFault thread x5) (\<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5))
 2. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> (?xf'878 x5 thread) rv' t t' (IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL handleFault_'proc(\<acute>ksCurThread)
FI) (?d'878 x5 thread rv')
 3. \<And>x5 thread rv rv'. \<lbrakk>e = VMFaultEvent x5; ?r'878 x5 thread rv (?vf'878 x5 thread rv'); ?ef'878 x5 thread rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (?r'872 x5 thread) (?xf'872 x5 thread) (?Q878 x5 thread rv) (?Q'878 x5 thread rv rv') [] (return rv) (?d'878 x5 thread rv')
 4. \<And>x5 thread err rv' err'. \<lbrakk>e = VMFaultEvent x5; ?ef'878 x5 thread rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'878 x5 thread err (?ef'878 x5 thread rv') err'\<rbrakk> \<Longrightarrow> ccorres (?r'872 x5 thread) (?xf'872 x5 thread) (?QE878 x5 thread err) (?Q''878 x5 thread err rv' err') [] (handleFault thread err) (?d'878 x5 thread rv')
 5. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R878 x5 thread\<rbrace> handleVMFault thread x5 \<lbrace>?Q878 x5 thread\<rbrace>, \<lbrace>?QE878 x5 thread\<rbrace>
 6. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. (\<forall>rv'. ?ef'878 x5 thread (?xf'878 x5 thread s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ?r'878 x5 thread rv' (?vf'878 x5 thread (?xf'878 x5 thread s)) \<longrightarrow> s \<in> ?Q'878 x5 thread rv' (?xf'878 x5 thread s)) \<and> (\<forall>ft. ?ef'878 x5 thread (?xf'878 x5 thread s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ?f'878 x5 thread ft (?ef'878 x5 thread (?xf'878 x5 thread s)) (?es878 x5 thread s) \<longrightarrow> s \<in> ?Q''878 x5 thread ft (?xf'878 x5 thread s) (?es878 x5 thread s))}
 7. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> (?xf'872 x5 thread) rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 8. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; ?r'872 x5 thread r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 9. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 10. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV (?r'872 x5 thread) (?xf'872 x5 thread) (?Q'872 x5 thread)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> status_' rv' t t' (IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL handleFault_'proc(\<acute>ksCurThread)
FI) (?d'878 x5 thread rv')
 2. \<And>x5 thread rv rv'. \<lbrakk>e = VMFaultEvent x5; False; id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (?r'872 x5 thread) (?xf'872 x5 thread) (?Q878 x5 thread rv) (?Q'878 x5 thread rv rv') [] (return rv) (?d'878 x5 thread rv')
 3. \<And>x5 thread err rv' err'. \<lbrakk>e = VMFaultEvent x5; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. err = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault err' = Some (SeL4_Fault_VMFault vf))\<rbrakk> \<Longrightarrow> ccorres (?r'872 x5 thread) (?xf'872 x5 thread) (?QE878 x5 thread err) (?Q''878 x5 thread err rv' err') [] (handleFault thread err) (?d'878 x5 thread rv')
 4. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R878 x5 thread\<rbrace> handleVMFault thread x5 \<lbrace>?Q878 x5 thread\<rbrace>, \<lbrace>?QE878 x5 thread\<rbrace>
 5. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. (\<forall>rv'. id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False \<longrightarrow> s \<in> ?Q'878 x5 thread rv' (status_' s)) \<and> (\<forall>ft. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault (errstate s) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> s \<in> ?Q''878 x5 thread ft (status_' s) (errstate s))}
 6. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> (?xf'872 x5 thread) rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 7. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; ?r'872 x5 thread r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 8. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 9. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV (?r'872 x5 thread) (?xf'872 x5 thread) (?Q'872 x5 thread)
 10. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x5 thread rv rv'. \<lbrakk>e = VMFaultEvent x5; False; id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (?r'872 x5 thread) (?xf'872 x5 thread) (?Q878 x5 thread rv) (?Q'878 x5 thread rv rv') [] (return rv) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL handleFault_'proc(\<acute>ksCurThread)
FI)
 2. \<And>x5 thread err rv' err'. \<lbrakk>e = VMFaultEvent x5; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. err = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault err' = Some (SeL4_Fault_VMFault vf))\<rbrakk> \<Longrightarrow> ccorres (?r'872 x5 thread) (?xf'872 x5 thread) (?QE878 x5 thread err) (?Q''878 x5 thread err rv' err') [] (handleFault thread err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL handleFault_'proc(\<acute>ksCurThread)
FI)
 3. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R878 x5 thread\<rbrace> handleVMFault thread x5 \<lbrace>?Q878 x5 thread\<rbrace>, \<lbrace>?QE878 x5 thread\<rbrace>
 4. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. (\<forall>rv'. id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False \<longrightarrow> s \<in> ?Q'878 x5 thread rv' (status_' s)) \<and> (\<forall>ft. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault (errstate s) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> s \<in> ?Q''878 x5 thread ft (status_' s) (errstate s))}
 5. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> (?xf'872 x5 thread) rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 6. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; ?r'872 x5 thread r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 7. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 8. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV (?r'872 x5 thread) (?xf'872 x5 thread) (?Q'872 x5 thread)
 9. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R878 x rv and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> ?R'878 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (9 subgoals):
 1. \<And>x5 thread err rv' err'. \<lbrakk>e = VMFaultEvent x5; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. err = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault err' = Some (SeL4_Fault_VMFault vf))\<rbrakk> \<Longrightarrow> ccorres (?r'872 x5 thread) (?xf'872 x5 thread) (?QE878 x5 thread err) (?Q''878 x5 thread err rv' err') [] (handleFault thread err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL handleFault_'proc(\<acute>ksCurThread)
FI)
 2. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R878 x5 thread\<rbrace> handleVMFault thread x5 \<lbrace>?Q878 x5 thread\<rbrace>, \<lbrace>?QE878 x5 thread\<rbrace>
 3. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. (\<forall>rv'. id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False \<longrightarrow> s \<in> ?Q'878 x5 thread rv' (status_' s)) \<and> (\<forall>ft. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault (errstate s) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> s \<in> ?Q''878 x5 thread ft (status_' s) (errstate s))}
 4. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> (?xf'872 x5 thread) rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 5. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; ?r'872 x5 thread r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 6. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 7. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV (?r'872 x5 thread) (?xf'872 x5 thread) (?Q'872 x5 thread)
 8. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R878 x rv and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> ?R'878 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (9 subgoals):
 1. \<And>x5 thread err' vf. \<lbrakk>e = VMFaultEvent x5; EXCEPTION_FAULT \<noteq> EXCEPTION_NONE; errfault err' = Some (SeL4_Fault_VMFault vf)\<rbrakk> \<Longrightarrow> ccorres (?r'872 x5 thread) (?xf'872 x5 thread) (?QE878 x5 thread (Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]))) (?Q''878 x5 thread (Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf])) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) err') [] (handleFault thread (Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]))) (Cond UNIV (CALL handleFault_'proc(\<acute>ksCurThread)) SKIP)
 2. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R878 x5 thread\<rbrace> handleVMFault thread x5 \<lbrace>?Q878 x5 thread\<rbrace>, \<lbrace>?QE878 x5 thread\<rbrace>
 3. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. (\<forall>rv'. id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False \<longrightarrow> s \<in> ?Q'878 x5 thread rv' (status_' s)) \<and> (\<forall>ft. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault (errstate s) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> s \<in> ?Q''878 x5 thread ft (status_' s) (errstate s))}
 4. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> (?xf'872 x5 thread) rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 5. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; ?r'872 x5 thread r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 6. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 7. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV (?r'872 x5 thread) (?xf'872 x5 thread) (?Q'872 x5 thread)
 8. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R878 x rv and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> ?R'878 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (9 subgoals):
 1. \<And>x5 thread err' vf. \<lbrakk>e = VMFaultEvent x5; EXCEPTION_FAULT \<noteq> EXCEPTION_NONE; errfault err' = Some (SeL4_Fault_VMFault vf)\<rbrakk> \<Longrightarrow> ccorres (?r'872 x5 thread) (?xf'872 x5 thread) (?QE878 x5 thread (Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]))) (?Q''878 x5 thread (Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf])) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) err') [] (handleFault thread (Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]))) (CALL handleFault_'proc(\<acute>ksCurThread))
 2. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R878 x5 thread\<rbrace> handleVMFault thread x5 \<lbrace>?Q878 x5 thread\<rbrace>, \<lbrace>?QE878 x5 thread\<rbrace>
 3. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. (\<forall>rv'. id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False \<longrightarrow> s \<in> ?Q'878 x5 thread rv' (status_' s)) \<and> (\<forall>ft. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault (errstate s) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> s \<in> ?Q''878 x5 thread ft (status_' s) (errstate s))}
 4. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> (?xf'872 x5 thread) rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 5. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; ?r'872 x5 thread r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 6. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 7. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV (?r'872 x5 thread) (?xf'872 x5 thread) (?Q'872 x5 thread)
 8. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R878 x rv and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> ?R'878 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (9 subgoals):
 1. \<And>x5 thread err' vf. \<lbrakk>e = VMFaultEvent x5; EXCEPTION_FAULT \<noteq> EXCEPTION_NONE; errfault err' = Some (SeL4_Fault_VMFault vf)\<rbrakk> \<Longrightarrow> ccorres (?r'872 x5 thread) (?xf'872 x5 thread) (?P'1826 x5 thread (Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]))) (?Q1825 x5 thread (Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf])) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) err') [] (handleFault thread (Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]))) (CALL handleFault_'proc(\<acute>ksCurThread))
 2. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R878 x5 thread\<rbrace> handleVMFault thread x5 \<lbrace>?Q878 x5 thread\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>s. thread = ksCurThread s) and ?P'1826 x5 thread a\<rbrace>
 3. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. (\<forall>rv'. id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False \<longrightarrow> s \<in> ?Q'878 x5 thread rv' (status_' s)) \<and> (\<forall>ft. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault (errstate s) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> thread = ksCurThread sa \<longrightarrow> s' \<in> ?Q1825 x5 thread ft (status_' s) (errstate s)})}
 4. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> (?xf'872 x5 thread) rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 5. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; ?r'872 x5 thread r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 6. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 7. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV (?r'872 x5 thread) (?xf'872 x5 thread) (?Q'872 x5 thread)
 8. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R878 x rv and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> ?R'878 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (12 subgoals):
 1. \<And>x5 thread err' vf. \<lbrakk>e = VMFaultEvent x5; EXCEPTION_FAULT \<noteq> EXCEPTION_NONE; errfault err' = Some (SeL4_Fault_VMFault vf)\<rbrakk> \<Longrightarrow> ccorres (?r'872 x5 thread) (?xf''1828 x5 thread err' vf) (?P'1826 x5 thread (Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]))) (?C'1833 x5 thread (Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf])) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) err') [] (handleFault thread (Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]))) (com.Call handleFault_'proc)
 2. \<And>x5 thread err' vf x y s. \<lbrakk>e = VMFaultEvent x5; EXCEPTION_FAULT \<noteq> EXCEPTION_NONE; errfault err' = Some (SeL4_Fault_VMFault vf)\<rbrakk> \<Longrightarrow> globals s = globals s
 3. \<And>x5 thread err' vf a s t. \<lbrakk>e = VMFaultEvent x5; EXCEPTION_FAULT \<noteq> EXCEPTION_NONE; errfault err' = Some (SeL4_Fault_VMFault vf)\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>globals := globals t\<rparr>) = ?xf''1828 x5 thread err' vf t
 4. \<And>x5 thread err' vf s. \<lbrakk>e = VMFaultEvent x5; EXCEPTION_FAULT \<noteq> EXCEPTION_NONE; errfault err' = Some (SeL4_Fault_VMFault vf)\<rbrakk> \<Longrightarrow> globals (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) = globals s
 5. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R878 x5 thread\<rbrace> handleVMFault thread x5 \<lbrace>?Q878 x5 thread\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>s. thread = ksCurThread s) and ?P'1826 x5 thread a\<rbrace>
 6. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. (\<forall>rv'. id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False \<longrightarrow> s \<in> ?Q'878 x5 thread rv' (status_' s)) \<and> (\<forall>ft. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault (errstate s) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> thread = ksCurThread sa \<longrightarrow> s' \<in> {sa. tptr_'_update (\<lambda>_. ksCurThread_' (globals sa)) sa \<in> ?C'1833 x5 thread ft (status_' s) (errstate s)}})}
 7. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 8. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; ?r'872 x5 thread r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 9. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 10. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV (?r'872 x5 thread) xfdc (?Q'872 x5 thread)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x5 thread err' vf x y s. \<lbrakk>e = VMFaultEvent x5; EXCEPTION_FAULT \<noteq> EXCEPTION_NONE; errfault err' = Some (SeL4_Fault_VMFault vf)\<rbrakk> \<Longrightarrow> globals s = globals s
 2. \<And>x5 thread err' vf a s t. \<lbrakk>e = VMFaultEvent x5; EXCEPTION_FAULT \<noteq> EXCEPTION_NONE; errfault err' = Some (SeL4_Fault_VMFault vf)\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>globals := globals t\<rparr>) = xfdc t
 3. \<And>x5 thread err' vf s. \<lbrakk>e = VMFaultEvent x5; EXCEPTION_FAULT \<noteq> EXCEPTION_NONE; errfault err' = Some (SeL4_Fault_VMFault vf)\<rbrakk> \<Longrightarrow> globals (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) = globals s
 4. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R878 x5 thread\<rbrace> handleVMFault thread x5 \<lbrace>?Q878 x5 thread\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>s. thread = ksCurThread s) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)))\<rbrace>
 5. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. (\<forall>rv'. id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False \<longrightarrow> s \<in> ?Q'878 x5 thread rv' (status_' s)) \<and> (\<forall>ft. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault (errstate s) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> thread = ksCurThread s \<longrightarrow> s' \<in> {s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some ft) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>}})}
 6. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 7. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; dc r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 8. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 9. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'872 x5 thread)
 10. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x5 thread err' vf a s t. \<lbrakk>e = VMFaultEvent x5; EXCEPTION_FAULT \<noteq> EXCEPTION_NONE; errfault err' = Some (SeL4_Fault_VMFault vf)\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>globals := globals t\<rparr>) = xfdc t
 2. \<And>x5 thread err' vf s. \<lbrakk>e = VMFaultEvent x5; EXCEPTION_FAULT \<noteq> EXCEPTION_NONE; errfault err' = Some (SeL4_Fault_VMFault vf)\<rbrakk> \<Longrightarrow> globals (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) = globals s
 3. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R878 x5 thread\<rbrace> handleVMFault thread x5 \<lbrace>?Q878 x5 thread\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>s. thread = ksCurThread s) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)))\<rbrace>
 4. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. (\<forall>rv'. id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False \<longrightarrow> s \<in> ?Q'878 x5 thread rv' (status_' s)) \<and> (\<forall>ft. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault (errstate s) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> thread = ksCurThread s \<longrightarrow> s' \<in> {s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some ft) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>}})}
 5. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 6. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; dc r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 7. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 8. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'872 x5 thread)
 9. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R878 x rv and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> ?R'878 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (9 subgoals):
 1. \<And>x5 thread err' vf s. \<lbrakk>e = VMFaultEvent x5; EXCEPTION_FAULT \<noteq> EXCEPTION_NONE; errfault err' = Some (SeL4_Fault_VMFault vf)\<rbrakk> \<Longrightarrow> globals (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) = globals s
 2. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R878 x5 thread\<rbrace> handleVMFault thread x5 \<lbrace>?Q878 x5 thread\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>s. thread = ksCurThread s) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)))\<rbrace>
 3. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. (\<forall>rv'. id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False \<longrightarrow> s \<in> ?Q'878 x5 thread rv' (status_' s)) \<and> (\<forall>ft. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault (errstate s) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> thread = ksCurThread s \<longrightarrow> s' \<in> {s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some ft) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>}})}
 4. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 5. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; dc r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 6. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 7. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'872 x5 thread)
 8. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R878 x rv and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> ?R'878 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (8 subgoals):
 1. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R878 x5 thread\<rbrace> handleVMFault thread x5 \<lbrace>?Q878 x5 thread\<rbrace>, \<lbrace>\<lambda>a. (\<lambda>s. thread = ksCurThread s) and (invs' and st_tcb_at' simple' thread and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)))\<rbrace>
 2. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. (\<forall>rv'. id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False \<longrightarrow> s \<in> ?Q'878 x5 thread rv' (status_' s)) \<and> (\<forall>ft. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault (errstate s) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> thread = ksCurThread s \<longrightarrow> s' \<in> {s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some ft) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>}})}
 3. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 4. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; dc r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 5. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 6. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'872 x5 thread)
 7. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ?R878 x rv and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> ?R'878 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (7 subgoals):
 1. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. (\<forall>rv'. id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False \<longrightarrow> s \<in> ?Q'878 x5 thread rv' (status_' s)) \<and> (\<forall>ft. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> errfault (errstate s) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> thread = ksCurThread s \<longrightarrow> s' \<in> {s. tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>cfault_rel (Some ft) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>}})}
 2. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 3. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; dc r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 4. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 5. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'872 x5 thread)
 6. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>s. rv = ksCurThread s) and (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)))) and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> ?R'878 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (7 subgoals):
 1. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'878 x5 thread) \<acute>status :== CALL handleVMFault_'proc(\<acute>ksCurThread,vm_fault_type_from_H x5) {s. status_' s \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. status_' s = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> seL4_Fault_lift (current_fault_' (globals s)) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> (\<forall>sa. (sa, s) \<in> rf_sr \<and> thread = ksCurThread sa \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr (ksCurThread sa)))}
 2. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 3. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; dc r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 4. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 5. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'872 x5 thread)
 6. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>s. rv = ksCurThread s) and (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)))) and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> ?R'878 x rv}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (6 subgoals):
 1. \<And>x5 thread rv' t t'. e = VMFaultEvent x5 \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (?d'872 x5 thread rv')
 2. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; dc r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (?d'872 x5 thread rv')
 3. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 4. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'872 x5 thread)
 5. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>s. rv = ksCurThread s) and (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)))) and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> {s. \<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> seL4_Fault_lift (current_fault_' (globals t)) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> (\<forall>sa. (sa, status_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>)) \<in> rf_sr \<and> rv = ksCurThread sa \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (current_fault_' (globals t))) (lookup_fault_lift (current_lookup_fault_' (globals t))) \<and> ksCurThread_' (globals t) = tcb_ptr_to_ctcb_ptr (ksCurThread sa)))}}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (5 subgoals):
 1. \<And>x5 thread r rv'. \<lbrakk>e = VMFaultEvent x5; dc r rv'\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread r) (?Q'872 x5 thread r rv') [] (return (Inr ())) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 3. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'872 x5 thread)
 4. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>s. rv = ksCurThread s) and (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)))) and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> {s. \<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> seL4_Fault_lift (current_fault_' (globals t)) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> (\<forall>sa. (sa, status_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>)) \<in> rf_sr \<and> rv = ksCurThread sa \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (current_fault_' (globals t))) (lookup_fault_lift (current_lookup_fault_' (globals t))) \<and> ksCurThread_' (globals t) = tcb_ptr_to_ctcb_ptr (ksCurThread sa)))}}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (5 subgoals):
 1. \<And>x5 thread rv'. e = VMFaultEvent x5 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q872 x5 thread ()) (?Q'872 x5 thread () rv') [] (return (Inr ())) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>?Q872 x5 thread\<rbrace>
 3. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'872 x5 thread)
 4. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>s. rv = ksCurThread s) and (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)))) and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> {s. \<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> seL4_Fault_lift (current_fault_' (globals t)) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> (\<forall>sa. (sa, status_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>)) \<in> rf_sr \<and> rv = ksCurThread sa \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (current_fault_' (globals t))) (lookup_fault_lift (current_lookup_fault_' (globals t))) \<and> ksCurThread_' (globals t) = tcb_ptr_to_ctcb_ptr (ksCurThread sa)))}}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (5 subgoals):
 1. \<And>x5 thread rv'. e = VMFaultEvent x5 \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 4. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>s. rv = ksCurThread s) and (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)))) and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> {s. \<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> seL4_Fault_lift (current_fault_' (globals t)) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> (\<forall>sa. (sa, status_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>)) \<in> rf_sr \<and> rv = ksCurThread sa \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (current_fault_' (globals t))) (lookup_fault_lift (current_lookup_fault_' (globals t))) \<and> ksCurThread_' (globals t) = tcb_ptr_to_ctcb_ptr (ksCurThread sa)))}}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (5 subgoals):
 1. \<And>x5 thread rv' \<sigma>. e = VMFaultEvent x5 \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>))}
 2. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 4. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>s. rv = ksCurThread s) and (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)))) and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> {s. \<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> seL4_Fault_lift (current_fault_' (globals t)) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> (\<forall>sa. (sa, status_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>)) \<in> rf_sr \<and> rv = ksCurThread sa \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (current_fault_' (globals t))) (lookup_fault_lift (current_lookup_fault_' (globals t))) \<and> ksCurThread_' (globals t) = tcb_ptr_to_ctcb_ptr (ksCurThread sa)))}}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (4 subgoals):
 1. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> \<lbrace>?R872 x5 thread\<rbrace> do x <- handleVMFault thread x5;
case x of Inl e \<Rightarrow> handleFault thread e | Inr b \<Rightarrow> return b
od \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>s. rv = ksCurThread s) and (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)))) and ?R872 x rv) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> {s. \<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> seL4_Fault_lift (current_fault_' (globals t)) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> (\<forall>sa. (sa, status_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>)) \<in> rf_sr \<and> rv = ksCurThread sa \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (current_fault_' (globals t))) (lookup_fault_lift (current_lookup_fault_' (globals t))) \<and> ksCurThread_' (globals t) = tcb_ptr_to_ctcb_ptr (ksCurThread sa)))}}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (3 subgoals):
 1. \<And>x5 thread. e = VMFaultEvent x5 \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 2. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>s. rv = ksCurThread s) and (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)))) and (\<lambda>s. True)) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> {s. \<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> seL4_Fault_lift (current_fault_' (globals t)) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> (\<forall>sa. (sa, status_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>)) \<in> rf_sr \<and> rv = ksCurThread sa \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (current_fault_' (globals t))) (lookup_fault_lift (current_lookup_fault_' (globals t))) \<and> ksCurThread_' (globals t) = tcb_ptr_to_ctcb_ptr (ksCurThread sa)))}}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (2 subgoals):
 1. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R40 x6) (?R''46 x6) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. e = SyscallEvent x \<longrightarrow> (x = syscall.SysCall \<longrightarrow> (invs' and arch_extras and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysReplyRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. (invs' and sch_act_simple) a \<and> ct_in_state' simple' a \<and> sch_act_sane a \<and> (invs' and sch_act_simple and ct_in_state' simple' and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) a)) s) \<and> (x = syscall.SysSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysNBSend \<longrightarrow> (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ct_active' and sch_act_simple and (\<lambda>s. \<forall>x. ksCurThread s \<notin> set (ksReadyQueues s x))) s) \<and> (x = syscall.SysRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s) \<and> (x = syscall.SysReply \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' (\<lambda>a. \<not> isReply a) (ksCurThread a) a \<and> sch_act_simple a) and (\<lambda>a. True)) s) \<and> (x = syscall.SysYield \<longrightarrow> (invs' and ct_active' and (\<lambda>a. True)) s) \<and> (x = syscall.SysNBRecv \<longrightarrow> ((\<lambda>a. invs' a \<and> st_tcb_at' simple' (ksCurThread a) a \<and> sch_act_sane a \<and> (\<forall>p. ksCurThread a \<notin> set (ksReadyQueues a p))) and (\<lambda>a. True)) s)) \<and> (\<forall>x. e = UnknownSyscall x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (\<forall>x xa. e = UserLevelFault x xa \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)) and (\<lambda>s. True)) s)) \<and> (e = Interrupt \<longrightarrow> invs' s) \<and> (\<forall>x. e = VMFaultEvent x \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and ((\<lambda>s. rv = ksCurThread s) and (invs' and st_tcb_at' simple' rv and sch_act_not rv and (\<lambda>s. \<forall>p. rv \<notin> set (ksReadyQueues s p)))) and (\<lambda>s. True)) s)) \<and> (\<forall>x. e = HypervisorEvent x \<longrightarrow> ?R40 x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. e = SyscallEvent x \<longrightarrow> s \<in> {s. x = syscall.SysCall \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysReplyRecv \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> ({s. x = syscall.SysSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>}} \<inter> ({s. x = syscall.SysNBSend \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (isCall_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>isCall = from_bool False\<rbrace> \<inter> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>}} \<inter> ({s. x = syscall.SysRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> \<lbrace>\<acute>isBlocking = from_bool True\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysReply \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> ({s. x = syscall.SysYield \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}} \<inter> {s. x = syscall.SysNBRecv \<longrightarrow> s \<in> {s. isBlocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s \<in> \<lbrace>\<acute>isBlocking = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}))))))}} \<inter> ({s. \<forall>x. s \<in> {s. e = UnknownSyscall x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UnknownSyscall_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>syscallNumber_CL = word_of_nat x && mask 32\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UnknownSyscall \<longrightarrow> cfault_rel (Some (Fault_H.fault.UnknownSyscallException (word_of_nat x))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. e = UserLevelFault x xa \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> \<lbrace>\<forall>t. seL4_Fault_UserException_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = \<lparr>number_CL = x && mask 32, code_CL = xa && mask 28\<rparr> \<and> seL4_Fault_get_tag \<^bsup>t\<^esup>ret__struct_seL4_Fault_C = SCAST(32 signed \<rightarrow> 32) seL4_Fault_UserException \<longrightarrow> cfault_rel (Some (Fault_H.fault.UserException x (xa && mask 28))) (seL4_Fault_lift \<^bsup>t\<^esup>ret__struct_seL4_Fault_C) (lookup_fault_lift \<acute>current_lookup_fault) \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv\<rbrace>}}}} \<inter> ({s. e = Interrupt \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. e = VMFaultEvent x \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. vm_faultType_'_update (\<lambda>_. vm_fault_type_from_H x) (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vm_faultType = vm_fault_type_from_H x\<rbrace>} \<inter> {s. \<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ft. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<and> (\<exists>vf. ft = Fault_H.fault.ArchFault (ARM_H.VMFault (seL4_Fault_VMFault_CL.address_CL vf) [instructionFault_CL vf, FSR_CL vf]) \<and> seL4_Fault_lift (current_fault_' (globals t)) = Some (SeL4_Fault_VMFault vf)) \<longrightarrow> (\<forall>sa. (sa, status_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>)) \<in> rf_sr \<and> rv = ksCurThread sa \<longrightarrow> cfault_rel (Some ft) (seL4_Fault_lift (current_fault_' (globals t))) (lookup_fault_lift (current_lookup_fault_' (globals t))) \<and> ksCurThread_' (globals t) = tcb_ptr_to_ctcb_ptr (ksCurThread sa)))}}}} \<inter> {s. \<forall>x. s \<in> {s. e = HypervisorEvent x \<longrightarrow> s \<in> ?R''46 x}})))) proof (prove)
goal (1 subgoal):
 1. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (UNIV `` {?a2119 x6}) [] (liftE (do thread <- getCurThread;
handleHypervisorFault thread x6
od)) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) proof (prove)
goal (1 subgoal):
 1. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (UNIV `` {?a2119 x6}) [] (do thread <- getCurThread;
r <- handleHypervisorFault thread x6;
return (Inr ())
od) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) proof (prove)
goal (2 subgoals):
 1. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2137 x6) (?Q'2137 x6) [] (do thread <- getCurThread;
r <- handleHypervisorFault thread x6;
return (Inr ())
od) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x6 s s'. \<lbrakk>e = HypervisorEvent x6; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV `` {?a2119 x6}\<rbrakk> \<Longrightarrow> ?Q2137 x6 s \<and> s' \<in> ?Q'2137 x6 proof (prove)
goal (5 subgoals):
 1. \<And>x6 thread. e = HypervisorEvent x6 \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2140 x6 thread) (?Q'2140 x6 thread) [] (do r <- handleHypervisorFault thread x6;
return (Inr ())
od) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x6 s. e = HypervisorEvent x6 \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCurThread \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> \<lbrace>?Q2137 x6\<rbrace> getCurThread \<lbrace>?Q2140 x6\<rbrace>
 4. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> empty_fail getCurThread
 5. \<And>x6 s s'. \<lbrakk>e = HypervisorEvent x6; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV `` {?a2119 x6}\<rbrakk> \<Longrightarrow> ?Q2137 x6 s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q2140 x6 rv s \<longrightarrow> s' \<in> ?Q'2140 x6 rv} proof (prove)
goal (5 subgoals):
 1. \<And>x6 thread. \<lbrakk>e = HypervisorEvent ARMNoHypFaults; x6 = ARMNoHypFaults\<rbrakk> \<Longrightarrow> ccorres (K dc \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2140 ARMNoHypFaults thread) (?Q'2140 ARMNoHypFaults thread) [] (return (Inr ())) (\<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
 2. \<And>x6 s. e = HypervisorEvent x6 \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCurThread \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> \<lbrace>?Q2137 x6\<rbrace> getCurThread \<lbrace>?Q2140 x6\<rbrace>
 4. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> empty_fail getCurThread
 5. \<And>x6 s s'. \<lbrakk>e = HypervisorEvent x6; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV `` {?a2119 x6}\<rbrakk> \<Longrightarrow> ?Q2137 x6 s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q2140 x6 rv s \<longrightarrow> s' \<in> ?Q'2140 x6 rv} proof (prove)
goal (5 subgoals):
 1. \<And>x6 thread. \<lbrakk>e = HypervisorEvent ARMNoHypFaults; x6 = ARMNoHypFaults\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned_long :== SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>x6 s. e = HypervisorEvent x6 \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCurThread \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> \<lbrace>?Q2137 x6\<rbrace> getCurThread \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> empty_fail getCurThread
 5. \<And>x6 s s'. \<lbrakk>e = HypervisorEvent x6; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV `` {?a2119 x6}\<rbrakk> \<Longrightarrow> ?Q2137 x6 s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>x6 thread \<sigma>. \<lbrakk>e = HypervisorEvent ARMNoHypFaults; x6 = ARMNoHypFaults\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>) \<in> rf_sr \<and> (K dc \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rparr>))}
 2. \<And>x6 s. e = HypervisorEvent x6 \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCurThread \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> \<lbrace>?Q2137 x6\<rbrace> getCurThread \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> empty_fail getCurThread
 5. \<And>x6 s s'. \<lbrakk>e = HypervisorEvent x6; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV `` {?a2119 x6}\<rbrakk> \<Longrightarrow> ?Q2137 x6 s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>x6 s. e = HypervisorEvent x6 \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCurThread \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> \<lbrace>?Q2137 x6\<rbrace> getCurThread \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>x6. e = HypervisorEvent x6 \<Longrightarrow> empty_fail getCurThread
 4. \<And>x6 s s'. \<lbrakk>e = HypervisorEvent x6; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV `` {?a2119 x6}\<rbrakk> \<Longrightarrow> ?Q2137 x6 s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<And>x6 s s'. \<lbrakk>e = HypervisorEvent x6; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV `` {?a2119 x6}\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV} proof (prove)
goal:
No subgoals!