theory SyscallArgs_C

lemma getSyscallArg_ccorres_foo:
  "ccorres (\<lambda>a rv. rv = args ! n) ret__unsigned_long_'
         (sysargs_rel args buffer and sysargs_rel_n args buffer n)
         (UNIV \<inter> \<lbrace>unat \<acute>i = n\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>) []
    (return ()) (Call getSyscallArg_'proc)" apply (rule ccorres_assume_pre) apply (subst (asm) sysargs_rel_def) apply (subst (asm) getMRs_rel_def) apply (subst (asm) pred_conj_def)+ apply (elim conjE exE) apply (cinit lift: i_' ipc_buffer_') apply (fold return_def) apply (rule_tac H="do thread \<leftarrow> gets ksCurThread; getMRs thread buffer mi od" in ccorres_defer) prefer 2 apply (rule no_fail_pre, wp no_fail_getMRs) apply assumption apply (rule ccorres_cond_seq) apply (rule_tac R=\<top> and P="\<lambda>_. n < unat (scast n_msgRegisters :: word32)" in ccorres_cond_both) apply (simp add: word_less_nat_alt split: if_split) apply (rule ccorres_add_return2) apply (rule ccorres_symb_exec_l) apply (rule_tac P="\<lambda>s. n < unat (scast n_msgRegisters :: word32) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (ARM_H.msgRegisters!n) = x!n) (ksCurThread s) s"
                   and P' = UNIV
         in ccorres_from_vcg_split_throws) apply vcg apply (simp add: return_def del: Collect_const) apply (rule conseqPre, vcg) apply (clarsimp simp: rf_sr_ksCurThread) apply (drule (1) obj_at_cslift_tcb) apply (clarsimp simp: typ_heap_simps') apply (clarsimp simp: ctcb_relation_def ccontext_relation_def
                             msgRegisters_ccorres atcbContextGet_def
                             carch_tcb_relation_def) apply (subst (asm) msgRegisters_ccorres) apply (clarsimp simp: n_msgRegisters_def) apply (simp add: n_msgRegisters_def word_less_nat_alt) apply (simp add: index_msgRegisters_less unat_less_helper) apply wp[1] apply (wp getMRs_tcbContext) apply fastforce apply (rule ccorres_seq_skip [THEN iffD2]) apply (rule ccorres_add_return2) apply (rule ccorres_symb_exec_l) apply (rule_tac P="\<lambda>s. user_word_at (x!n) (ptr_val (CTypesDefs.ptr_add ipc_buffer (of_nat n + 1))) s
                      \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength"
                  and P'=UNIV
                   in ccorres_from_vcg_throws) apply (simp add: return_def split del: if_split) apply (rule allI, rule conseqPre, vcg) apply (clarsimp split del: if_split) apply (frule(1) user_word_at_cross_over, rule refl) apply (clarsimp simp: ptr_add_def mult.commute
                            msgMaxLength_def) apply (safe intro!: disjCI2 elim!: valid_ipc_buffer_ptr_array,
        simp_all add: unatSuc2 add.commute msg_align_bits)[1] apply wp[1] apply (rule_tac P="\<exists>b. buffer = Some b" in hoare_gen_asm) apply (clarsimp simp: option_to_ptr_def option_to_0_def) apply (rule_tac P="\<lambda>s. valid_ipc_buffer_ptr' (ptr_val (Ptr b)) s \<and> i < msgLength mi \<and>
                           msgLength mi \<le> msgMaxLength \<and> scast n_msgRegisters \<le> i"
                 in hoare_pre(1)) apply (wp getMRs_user_word) apply (clarsimp simp: msgMaxLength_def unat_less_helper) apply fastforce apply (clarsimp simp: sysargs_rel_def sysargs_rel_n_def) apply (rule conjI, clarsimp simp: unat_of_nat32 word_bits_def) apply (drule equalityD2) apply clarsimp apply (drule use_valid, rule getMRs_length, assumption) apply (simp add: n_msgRegisters_def  split: if_split_asm) apply (rule conjI) apply (clarsimp simp: option_to_ptr_def option_to_0_def
      word_less_nat_alt word_le_nat_alt unat_of_nat32 word_bits_def
      n_msgRegisters_def not_less msgMaxLength_def) apply (drule equalityD2) apply clarsimp apply (drule use_valid, rule getMRs_length) apply (simp add: word_le_nat_alt msgMaxLength_def) apply (simp split: if_split_asm) apply (rule conjI, clarsimp simp: cur_tcb'_def) apply clarsimp apply (clarsimp simp: bind_def gets_def return_def split_def get_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>a rv. rv = args ! n) ret__unsigned_long_' (sysargs_rel args buffer and sysargs_rel_n args buffer n) (UNIV \<inter> \<lbrace>unat \<acute>i = n\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>) [] (return ()) (Call getSyscallArg_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>s. (sysargs_rel args buffer and sysargs_rel_n args buffer n) s \<Longrightarrow> ccorres (\<lambda>a rv. rv = args ! n) ret__unsigned_long_' (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) (UNIV \<inter> \<lbrace>unat \<acute>i = n\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>) [] (return ()) (Call getSyscallArg_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>s. (cur_tcb' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and getMRs_rel args buffer and (\<lambda>_. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> buffer \<noteq> None) and sysargs_rel_n args buffer n) s \<Longrightarrow> ccorres (\<lambda>a rv. rv = args ! n) ret__unsigned_long_' (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) (UNIV \<inter> \<lbrace>unat \<acute>i = n\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>) [] (return ()) (Call getSyscallArg_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>s. (cur_tcb' and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. \<exists>mi. msgLength mi \<le> msgMaxLength \<and> fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}) and (\<lambda>_. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> buffer \<noteq> None) and sysargs_rel_n args buffer n) s \<Longrightarrow> ccorres (\<lambda>a rv. rv = args ! n) ret__unsigned_long_' (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) (UNIV \<inter> \<lbrace>unat \<acute>i = n\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>) [] (return ()) (Call getSyscallArg_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>s. (((cur_tcb' s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s) \<and> (\<exists>mi. msgLength mi \<le> msgMaxLength \<and> fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)})) \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> buffer \<noteq> None)) \<and> sysargs_rel_n args buffer n s \<Longrightarrow> ccorres (\<lambda>a rv. rv = args ! n) ret__unsigned_long_' (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) (UNIV \<inter> \<lbrace>unat \<acute>i = n\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>) [] (return ()) (Call getSyscallArg_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>s mi. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> buffer \<noteq> None; cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a rv. rv = args ! n) ret__unsigned_long_' (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) (UNIV \<inter> \<lbrace>unat \<acute>i = n\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>) [] (return ()) (Call getSyscallArg_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a rv. rv = args ! n) ret__unsigned_long_' (?Q410 s mi ipc_buffer i) (?Q'410 s mi ipc_buffer i) [SKIP] (\<lambda>s. ({((), s)}, False)) (IF i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters THEN
  Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 2. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q410 s mi ipc_buffer i sa \<and> s' \<in> ?Q'410 s mi ipc_buffer i proof (prove)
goal (2 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a rv. rv = args ! n) ret__unsigned_long_' (?Q410 s mi ipc_buffer i) (?Q'410 s mi ipc_buffer i) [SKIP] (return ()) (IF i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters THEN
  Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 2. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q410 s mi ipc_buffer i sa \<and> s' \<in> ?Q'410 s mi ipc_buffer i proof (prove)
goal (3 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?P416 s mi ipc_buffer i) (?Q'410 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (IF i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters THEN
  Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> no_fail (?Q416 s mi ipc_buffer i) (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 3. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P416 s mi ipc_buffer i sa \<and> ?Q416 s mi ipc_buffer i sa \<and> (?P416 s mi ipc_buffer i sa \<and> ?Q416 s mi ipc_buffer i sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> ?Q'410 s mi ipc_buffer i proof (prove)
goal (3 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> no_fail (?Q416 s mi ipc_buffer i) (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?P416 s mi ipc_buffer i) (?Q'410 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (IF i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters THEN
  Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 3. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P416 s mi ipc_buffer i sa \<and> ?Q416 s mi ipc_buffer i sa \<and> (?P416 s mi ipc_buffer i sa \<and> ?Q416 s mi ipc_buffer i sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> ?Q'410 s mi ipc_buffer i proof (prove)
goal (3 subgoals):
 1. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; ?Q416 s mi ipc_buffer i sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?P416 s mi ipc_buffer i) (?Q'410 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (IF i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters THEN
  Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 3. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P416 s mi ipc_buffer i sa \<and> ?Q416 s mi ipc_buffer i sa \<and> (?P416 s mi ipc_buffer i sa \<and> ?Q416 s mi ipc_buffer i sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> ?Q'410 s mi ipc_buffer i proof (prove)
goal (2 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?P416 s mi ipc_buffer i) (?Q'410 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (IF i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters THEN
  Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 2. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P416 s mi ipc_buffer i sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (?P416 s mi ipc_buffer i sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> ?Q'410 s mi ipc_buffer i proof (prove)
goal (2 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?P416 s mi ipc_buffer i) (?Q'410 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (IF i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters THEN
  Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_';;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1))))))
ELSE
  SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1))))))
FI)
 2. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P416 s mi ipc_buffer i sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (?P416 s mi ipc_buffer i sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> ?Q'410 s mi ipc_buffer i proof (prove)
goal (4 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (s' \<in> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>)
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pt428 s mi ipc_buffer i) (?Rt428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_';;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 4. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> ?Rt428 s mi ipc_buffer i \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pt428 s mi ipc_buffer i) (?Rt428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_';;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 3. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> ?Rt428 s mi ipc_buffer i \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pt428 s mi ipc_buffer i) (?Rt428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od >>= return) (Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_';;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 3. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> ?Rt428 s mi ipc_buffer i \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s mi ipc_buffer i x. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Q436 s mi ipc_buffer i x) (?Q'436 s mi ipc_buffer i x) [SKIP] (return x) (Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_';;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>?Q436 s mi ipc_buffer i\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 6. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> ?Q436 s mi ipc_buffer i rv sa \<longrightarrow> s' \<in> ?Q'436 s mi ipc_buffer i rv} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s mi ipc_buffer i x. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'441 s mi ipc_buffer i x) Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_' {},UNIV
 2. \<And>s mi ipc_buffer i x \<sigma>. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. (n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread \<sigma>) \<sigma>) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_' UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (return x \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ret__unsigned_long_' s = rv ! n}
 3. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread s) s\<rbrace>
 5. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 6. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 7. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread sa) sa \<longrightarrow> s' \<in> UNIV \<inter> ?R'441 s mi ipc_buffer i rv} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s mi ipc_buffer i x \<sigma>. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. (n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread \<sigma>) \<sigma>) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[unat i]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_' UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (return x \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ret__unsigned_long_' s = rv ! n}
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread s) s\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 6. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s mi ipc_buffer i x \<sigma>. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread \<sigma>) \<sigma> \<and> (\<sigma>, s) \<in> rf_sr} Guard ArrayBounds \<lbrace>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(\<acute>ksCurThread,kernel_all_global_addresses.msgRegisters.[n]));;
return_C ret__unsigned_long_'_update ret__unsigned_long_' UNIV,{s. (\<sigma>, s) \<in> rf_sr \<and> ret__unsigned_long_' s = x ! n}
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread s) s\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 6. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s mi ipc_buffer i x \<sigma>. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> {s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread \<sigma>) \<sigma> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. i < 4 \<and> kernel_all_global_addresses.msgRegisters.[n] < SCAST(32 signed \<rightarrow> 32) 0x14 \<and> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<and> (\<sigma>, s\<lparr>ret__unsigned_long_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[n])], global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(ksCurThread_' (globals s)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[n])] = x ! n}
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread s) s\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 6. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s mi i x \<sigma> xa. \<lbrakk>sysargs_rel_n args buffer (unat i) s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; n = unat i; unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! unat i) = x ! unat i) (ksCurThread \<sigma>) \<sigma>; (\<sigma>, xa) \<in> rf_sr\<rbrakk> \<Longrightarrow> i < 4 \<and> kernel_all_global_addresses.msgRegisters.[unat i] < 0x14 \<and> xa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])] = x ! unat i
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread s) s\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 6. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s mi i x \<sigma> xa. \<lbrakk>sysargs_rel_n args buffer (unat i) s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; n = unat i; unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (\<sigma>, xa) \<in> rf_sr; \<exists>ko ko'. ko_at' ko (ksCurThread \<sigma>) \<sigma> \<and> atcbContextGet (tcbArch ko) (TCB_H.msgRegisters ! unat i) = x ! unat i \<and> cslift xa (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> i < 4 \<and> kernel_all_global_addresses.msgRegisters.[unat i] < 0x14 \<and> xa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])] = x ! unat i
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread s) s\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 6. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s mi i x \<sigma> xa ko ko'. \<lbrakk>sysargs_rel_n args buffer (unat i) s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; n = unat i; unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (\<sigma>, xa) \<in> rf_sr; ko_at' ko (ksCurThread \<sigma>) \<sigma>; atcbContextGet (tcbArch ko) (TCB_H.msgRegisters ! unat i) = x ! unat i; cslift xa (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'; ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> i < 4 \<and> kernel_all_global_addresses.msgRegisters.[unat i] < 0x14 \<and> registers_C (tcbContext_C (tcbArch_C ko')).[unat (kernel_all_global_addresses.msgRegisters.[unat i])] = x ! unat i
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread s) s\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 6. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s mi i x \<sigma> xa ko ko'. \<lbrakk>sysargs_rel_n args buffer (unat i) s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; n = unat i; unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (\<sigma>, xa) \<in> rf_sr; ko_at' ko (ksCurThread \<sigma>) \<sigma>; registers_C (tcbContext_C (tcbArch_C ko')).[unat (register_from_H (TCB_H.msgRegisters ! unat i))] = x ! unat i; cslift xa (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'; tcbFaultHandler ko = tcbFaultHandler_C ko'; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); tcbIPCBuffer ko = tcbIPCBuffer_C ko'; \<forall>r. atcbContext (tcbArch ko) r = registers_C (tcbContext_C (tcbArch_C ko')).[unat (register_from_H r)]; tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ko'))); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C ko'; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C ko'; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C ko'; tcbTimeSlice ko = unat (tcbTimeSlice_C ko'); cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C ko')) (lookup_fault_lift (tcbLookupFailure_C ko')); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'\<rbrakk> \<Longrightarrow> i < 4 \<and> kernel_all_global_addresses.msgRegisters.[unat i] < 0x14 \<and> registers_C (tcbContext_C (tcbArch_C ko')).[unat (kernel_all_global_addresses.msgRegisters.[unat i])] = x ! unat i
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread s) s\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 6. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s mi i x \<sigma> xa ko ko'. \<lbrakk>cslift xa (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'; tcbFaultHandler ko = tcbFaultHandler_C ko'; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); tcbIPCBuffer ko = tcbIPCBuffer_C ko'; \<forall>r. atcbContext (tcbArch ko) r = registers_C (tcbContext_C (tcbArch_C ko')).[unat (register_from_H r)]; tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ko'))); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C ko'; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C ko'; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C ko'; tcbTimeSlice ko = unat (tcbTimeSlice_C ko'); cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C ko')) (lookup_fault_lift (tcbLookupFailure_C ko')); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'; sysargs_rel_n args buffer (unat i) s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; n = unat i; unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (\<sigma>, xa) \<in> rf_sr; ko_at' ko (ksCurThread \<sigma>) \<sigma>\<rbrakk> \<Longrightarrow> unat i < unat n_msgRegisters
 2. \<And>s mi i x \<sigma> xa ko ko'. \<lbrakk>sysargs_rel_n args buffer (unat i) s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; n = unat i; unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (\<sigma>, xa) \<in> rf_sr; ko_at' ko (ksCurThread \<sigma>) \<sigma>; registers_C (tcbContext_C (tcbArch_C ko')).[unat (kernel_all_global_addresses.msgRegisters.[unat i])] = x ! unat i; cslift xa (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'; tcbFaultHandler ko = tcbFaultHandler_C ko'; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); tcbIPCBuffer ko = tcbIPCBuffer_C ko'; \<forall>r. atcbContext (tcbArch ko) r = registers_C (tcbContext_C (tcbArch_C ko')).[unat (register_from_H r)]; tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ko'))); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C ko'; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C ko'; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C ko'; tcbTimeSlice ko = unat (tcbTimeSlice_C ko'); cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C ko')) (lookup_fault_lift (tcbLookupFailure_C ko')); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'\<rbrakk> \<Longrightarrow> i < 4 \<and> kernel_all_global_addresses.msgRegisters.[unat i] < 0x14 \<and> registers_C (tcbContext_C (tcbArch_C ko')).[unat (kernel_all_global_addresses.msgRegisters.[unat i])] = x ! unat i
 3. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread s) s\<rbrace>
 5. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 6. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 7. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s mi i x \<sigma> xa ko ko'. \<lbrakk>sysargs_rel_n args buffer (unat i) s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; n = unat i; unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (\<sigma>, xa) \<in> rf_sr; ko_at' ko (ksCurThread \<sigma>) \<sigma>; registers_C (tcbContext_C (tcbArch_C ko')).[unat (kernel_all_global_addresses.msgRegisters.[unat i])] = x ! unat i; cslift xa (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'; tcbFaultHandler ko = tcbFaultHandler_C ko'; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); tcbIPCBuffer ko = tcbIPCBuffer_C ko'; \<forall>r. atcbContext (tcbArch ko) r = registers_C (tcbContext_C (tcbArch_C ko')).[unat (register_from_H r)]; tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ko'))); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C ko'; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C ko'; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C ko'; tcbTimeSlice ko = unat (tcbTimeSlice_C ko'); cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C ko')) (lookup_fault_lift (tcbLookupFailure_C ko')); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'\<rbrakk> \<Longrightarrow> i < 4 \<and> kernel_all_global_addresses.msgRegisters.[unat i] < 0x14 \<and> registers_C (tcbContext_C (tcbArch_C ko')).[unat (kernel_all_global_addresses.msgRegisters.[unat i])] = x ! unat i
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread s) s\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 6. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s mi i x \<sigma> xa ko ko'. \<lbrakk>sysargs_rel_n args buffer (unat i) s; 4 < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; n = unat i; unat i < 4; (\<sigma>, xa) \<in> rf_sr; ko_at' ko (ksCurThread \<sigma>) \<sigma>; registers_C (tcbContext_C (tcbArch_C ko')).[unat (kernel_all_global_addresses.msgRegisters.[unat i])] = x ! unat i; cslift xa (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'; tcbFaultHandler ko = tcbFaultHandler_C ko'; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); tcbIPCBuffer ko = tcbIPCBuffer_C ko'; \<forall>r. atcbContext (tcbArch ko) r = registers_C (tcbContext_C (tcbArch_C ko')).[unat (register_from_H r)]; tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ko'))); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C ko'; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C ko'; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C ko'; tcbTimeSlice ko = unat (tcbTimeSlice_C ko'); cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C ko')) (lookup_fault_lift (tcbLookupFailure_C ko')); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'\<rbrakk> \<Longrightarrow> unat (kernel_all_global_addresses.msgRegisters.[unat i]) < 20
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread s) s\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 6. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread s) s\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 5. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pt428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = x ! n) (ksCurThread s) s\<rbrace>
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 4. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>sa. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pt428 s mi ipc_buffer i sa) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 3. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (SKIP;;
Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 2. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od) (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 2. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Pf428 s mi ipc_buffer i) (?Rf428 s mi ipc_buffer i) [SKIP] (do thread <- gets ksCurThread;
getMRs thread buffer mi
od >>= return) (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 2. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> ?Rf428 s mi ipc_buffer i \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s mi ipc_buffer i x. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a aa. aa = a ! n) ret__unsigned_long_' (?Q569 s mi ipc_buffer i x) (?Q'569 s mi ipc_buffer i x) [SKIP] (return x) (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))))
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pf428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>?Q569 s mi ipc_buffer i\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> ?Q569 s mi ipc_buffer i rv sa \<longrightarrow> s' \<in> ?Q'569 s mi ipc_buffer i rv} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s mi ipc_buffer i x. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (user_word_at (x ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) \<sigma> \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) \<sigma> \<and> n < msgMaxLength) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipc_buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion ipc_buffer (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (ipc_buffer +\<^sub>p uint (i + 1)))))) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return x \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ret__unsigned_long_' s = rv ! n}
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pf428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. user_word_at (x ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s mi ipc_buffer i x. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. user_word_at (x ! n) (ptr_val (option_to_ptr buffer) + (4 * word_of_nat n + 4)) \<sigma> \<and> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) \<sigma> \<and> n < msgMaxLength \<and> (\<sigma>, s) \<in> rf_sr} Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion (option_to_ptr buffer) (unat (i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (option_to_ptr buffer +\<^sub>p uint (i + 1))} (Guard MemorySafety \<lbrace>i + 1 = 0 \<or> array_assertion (option_to_ptr buffer) (Suc (unat (i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (return_C ret__unsigned_long_'_update (\<lambda>s. h_val (hrs_mem (t_hrs_' (globals s))) (option_to_ptr buffer +\<^sub>p uint (i + 1)))))) {},{s. (\<sigma>, s) \<in> rf_sr \<and> ret__unsigned_long_' s = x ! n}
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pf428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. user_word_at (x ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s mi ipc_buffer i x \<sigma>. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> {s. user_word_at (x ! n) (ptr_val (option_to_ptr buffer) + (4 * word_of_nat n + 4)) \<sigma> \<and> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) \<sigma> \<and> n < msgMaxLength \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (i + 1 = 0 \<or> array_assertion (option_to_ptr buffer) (unat (i + 1)) (hrs_htd (t_hrs_' (globals s)))) \<and> s \<Turnstile>\<^sub>c (option_to_ptr buffer +\<^sub>p uint (i + 1)) \<and> (i + 1 = 0 \<or> array_assertion (option_to_ptr buffer) (Suc (unat (i + 1))) (hrs_htd (t_hrs_' (globals s)))) \<and> (\<sigma>, s\<lparr>ret__unsigned_long_' := h_val (hrs_mem (t_hrs_' (globals s))) (option_to_ptr buffer +\<^sub>p uint (i + 1)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> h_val (hrs_mem (t_hrs_' (globals s))) (option_to_ptr buffer +\<^sub>p uint (i + 1)) = x ! n}
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pf428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. user_word_at (x ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s mi i x \<sigma> xa. \<lbrakk>sysargs_rel_n args buffer (unat i) s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; n = unat i; user_word_at (x ! unat i) (ptr_val (option_to_ptr buffer) + (4 * i + 4)) \<sigma>; valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) \<sigma>; unat i < msgMaxLength; (\<sigma>, xa) \<in> rf_sr\<rbrakk> \<Longrightarrow> (i + 1 = 0 \<or> array_assertion (option_to_ptr buffer) (unat (i + 1)) (hrs_htd (t_hrs_' (globals xa)))) \<and> xa \<Turnstile>\<^sub>c (option_to_ptr buffer +\<^sub>p uint (i + 1)) \<and> (i + 1 = 0 \<or> array_assertion (option_to_ptr buffer) (Suc (unat (i + 1))) (hrs_htd (t_hrs_' (globals xa)))) \<and> h_val (hrs_mem (t_hrs_' (globals xa))) (option_to_ptr buffer +\<^sub>p uint (i + 1)) = x ! unat i
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pf428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. user_word_at (x ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s mi i x \<sigma> xa. \<lbrakk>sysargs_rel_n args buffer (unat i) s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; n = unat i; user_word_at (x ! unat i) (ptr_val (option_to_ptr buffer) + (4 * i + 4)) \<sigma>; valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) \<sigma>; unat i < msgMaxLength; (\<sigma>, xa) \<in> rf_sr; c_guard (PTR(32 word) (ptr_val (option_to_ptr buffer) + (4 * i + 4))) \<and> xa \<Turnstile>\<^sub>c PTR(32 word) (ptr_val (option_to_ptr buffer) + (4 * i + 4)) \<and> h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(32 word) (ptr_val (option_to_ptr buffer) + (4 * i + 4))) = x ! unat i\<rbrakk> \<Longrightarrow> (i + 1 = 0 \<or> array_assertion (option_to_ptr buffer) (unat (i + 1)) (hrs_htd (t_hrs_' (globals xa)))) \<and> xa \<Turnstile>\<^sub>c (option_to_ptr buffer +\<^sub>p uint (i + 1)) \<and> (i + 1 = 0 \<or> array_assertion (option_to_ptr buffer) (Suc (unat (i + 1))) (hrs_htd (t_hrs_' (globals xa)))) \<and> h_val (hrs_mem (t_hrs_' (globals xa))) (option_to_ptr buffer +\<^sub>p uint (i + 1)) = x ! unat i
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pf428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. user_word_at (x ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s mi i x \<sigma> xa. \<lbrakk>sysargs_rel_n args buffer (unat i) s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> 0x78; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; n = unat i; user_word_at (x ! unat i) (ptr_val (option_to_ptr buffer) + (i * 4 + 4)) \<sigma>; valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) \<sigma>; unat i < 120; (\<sigma>, xa) \<in> rf_sr; c_guard (PTR(32 word) (ptr_val (option_to_ptr buffer) + (i * 4 + 4))); xa \<Turnstile>\<^sub>c PTR(32 word) (ptr_val (option_to_ptr buffer) + (i * 4 + 4)); h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(32 word) (ptr_val (option_to_ptr buffer) + (i * 4 + 4))) = x ! unat i\<rbrakk> \<Longrightarrow> (i + 1 = 0 \<or> array_assertion (option_to_ptr buffer) (unat (i + 1)) (hrs_htd (t_hrs_' (globals xa)))) \<and> (i + 1 = 0 \<or> array_assertion (option_to_ptr buffer) (Suc (unat (i + 1))) (hrs_htd (t_hrs_' (globals xa))))
 2. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pf428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. user_word_at (x ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength\<rbrace>
 4. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 5. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s mi ipc_buffer i sa. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>r. (=) sa\<rbrace>
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pf428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. user_word_at (x ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength\<rbrace>
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 4. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> \<lbrace>?Pf428 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. user_word_at (x ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength\<rbrace>
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 3. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ?Pf428 s mi ipc_buffer i sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; \<exists>b. buffer = Some b\<rbrakk> \<Longrightarrow> \<lbrace>?P'640 s mi ipc_buffer i\<rbrace> do thread <- gets ksCurThread;
getMRs thread buffer mi
od \<lbrace>\<lambda>x s. user_word_at (x ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength\<rbrace>
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 3. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> (?P'640 s mi ipc_buffer i and K (\<exists>b. buffer = Some b)) sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> (?P'640 s mi ipc_buffer i and K (\<exists>b. buffer = Some b)) sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s mi i b. \<lbrakk>sysargs_rel_n args (Some b) (unat i) s; cur_tcb' s; valid_ipc_buffer_ptr' b s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) (Some b) mi s) = {(args, s)}; n = unat i; buffer = Some b\<rbrakk> \<Longrightarrow> \<lbrace>?P'640 s mi (PTR(32 word) b) i\<rbrace> do thread <- gets ksCurThread;
getMRs thread (Some b) mi
od \<lbrace>\<lambda>x s. user_word_at (x ! unat i) (b + (i * 4 + 4)) s \<and> valid_ipc_buffer_ptr' b s \<and> unat i < msgMaxLength\<rbrace>
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 3. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> (?P'640 s mi ipc_buffer i and K (\<exists>b. buffer = Some b)) sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>sa. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> (?P'640 s mi ipc_buffer i and K (\<exists>b. buffer = Some b)) sa)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s mi i b. \<lbrakk>sysargs_rel_n args (Some b) (unat i) s; cur_tcb' s; valid_ipc_buffer_ptr' b s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) (Some b) mi s) = {(args, s)}; n = unat i; buffer = Some b\<rbrakk> \<Longrightarrow> \<lbrace>?Q653 s mi i b\<rbrace> do thread <- gets ksCurThread;
getMRs thread (Some b) mi
od \<lbrace>\<lambda>x s. user_word_at (x ! unat i) (b + (i * 4 + 4)) s \<and> valid_ipc_buffer_ptr' b s \<and> unat i < msgMaxLength\<rbrace>
 2. \<And>s mi i b sa. \<lbrakk>sysargs_rel_n args (Some b) (unat i) s; cur_tcb' s; valid_ipc_buffer_ptr' b s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) (Some b) mi s) = {(args, s)}; n = unat i; buffer = Some b; valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) b)) sa \<and> i < msgLength mi \<and> msgLength mi \<le> msgMaxLength \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i\<rbrakk> \<Longrightarrow> ?Q653 s mi i b sa
 3. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 4. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>s. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ((\<lambda>a. valid_ipc_buffer_ptr' (ptr_val ipc_buffer) a \<and> i < msgLength mi \<and> msgLength mi \<le> msgMaxLength \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) and K (\<exists>b. buffer = Some b)) s)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>s. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ((\<lambda>a. valid_ipc_buffer_ptr' (ptr_val ipc_buffer) a \<and> i < msgLength mi \<and> msgLength mi \<le> msgMaxLength \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) and K (\<exists>b. buffer = Some b)) s)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s mi i b sa. \<lbrakk>sysargs_rel_n args (Some b) (unat i) s; cur_tcb' s; valid_ipc_buffer_ptr' b s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) (Some b) mi s) = {(args, s)}; n = unat i; buffer = Some b; valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) b)) sa \<and> i < msgLength mi \<and> msgLength mi \<le> msgMaxLength \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i\<rbrakk> \<Longrightarrow> (valid_ipc_buffer_ptr' b sa \<and> i < msgLength mi \<and> msgLength mi \<le> msgMaxLength \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> valid_ipc_buffer_ptr' b sa \<and> unat i < msgMaxLength
 2. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 3. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>s. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ((\<lambda>a. valid_ipc_buffer_ptr' (ptr_val ipc_buffer) a \<and> i < msgLength mi \<and> msgLength mi \<le> msgMaxLength \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) and K (\<exists>b. buffer = Some b)) s)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>s. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ((\<lambda>a. valid_ipc_buffer_ptr' (ptr_val ipc_buffer) a \<and> i < msgLength mi \<and> msgLength mi \<le> msgMaxLength \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) and K (\<exists>b. buffer = Some b)) s)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s mi ipc_buffer i. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n\<rbrakk> \<Longrightarrow> empty_fail (do thread <- gets ksCurThread;
getMRs thread buffer mi
od)
 2. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>s. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ((\<lambda>a. valid_ipc_buffer_ptr' (ptr_val ipc_buffer) a \<and> i < msgLength mi \<and> msgLength mi \<le> msgMaxLength \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) and K (\<exists>b. buffer = Some b)) s)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>s. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ((\<lambda>a. valid_ipc_buffer_ptr' (ptr_val ipc_buffer) a \<and> i < msgLength mi \<and> msgLength mi \<le> msgMaxLength \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) and K (\<exists>b. buffer = Some b)) s)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s mi ipc_buffer i sa s'. \<lbrakk>sysargs_rel_n args buffer n s; unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; ipc_buffer = option_to_ptr buffer; unat i = n; (sa, s') \<in> rf_sr; (sysargs_rel args buffer and sysargs_rel_n args buffer n and (\<lambda>s'. s' = s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>s. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ((\<lambda>a. valid_ipc_buffer_ptr' (ptr_val ipc_buffer) a \<and> i < msgLength mi \<and> msgLength mi \<le> msgMaxLength \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) and K (\<exists>b. buffer = Some b)) s)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<and> (((\<lambda>_. True) and (\<lambda>s. n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> n < unat n_msgRegisters \<and> n < unat (msgLength mi) \<and> ksCurThread s = ksCurThread s \<and> cur_tcb' s) and (\<lambda>s. \<not> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> ((\<lambda>a. valid_ipc_buffer_ptr' (ptr_val ipc_buffer) a \<and> i < msgLength mi \<and> msgLength mi \<le> msgMaxLength \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) and K (\<exists>b. buffer = Some b)) s)) sa \<and> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s)) sa \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) sa) = {(args, sa)})) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> n < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<and> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (TCB_H.msgRegisters ! n) = rv ! n) (ksCurThread s) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> \<union> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> user_word_at (rv ! n) (ptr_val (ipc_buffer +\<^sub>p (int n + 1))) s \<and> valid_ipc_buffer_ptr' (ptr_val ipc_buffer) s \<and> n < msgMaxLength \<longrightarrow> s' \<in> UNIV} \<inter> - \<lbrace>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> (unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<and> ((unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)}) proof (prove)
goal (2 subgoals):
 1. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args; unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)
 2. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<and> ((unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)}) proof (prove)
goal (2 subgoals):
 1. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args; unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); {(args, s)} \<subseteq> fst (getMRs (ksCurThread s) buffer mi s)\<rbrakk> \<Longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)
 2. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<and> ((unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)}) proof (prove)
goal (2 subgoals):
 1. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args; unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (args, s) \<in> fst (getMRs (ksCurThread s) buffer mi s)\<rbrakk> \<Longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)
 2. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<and> ((unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)}) proof (prove)
goal (2 subgoals):
 1. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args; unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); if buffer = None then length args = min (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (unat (msgLength mi)) else length args = unat (msgLength mi)\<rbrakk> \<Longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)
 2. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<and> ((unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)}) proof (prove)
goal (1 subgoal):
 1. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<and> ((unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)}) proof (prove)
goal (2 subgoals):
 1. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> \<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i
 2. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> ((unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)}) proof (prove)
goal (2 subgoals):
 1. \<And>s mi i s' y. \<lbrakk>cur_tcb' s; valid_ipc_buffer_ptr' y s; unat (msgLength mi) \<le> 120; fst (getMRs (ksCurThread s) (Some y) mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args (Some y) s; n = unat i; unat i < length args; 4 \<le> unat i; buffer = Some y\<rbrakk> \<Longrightarrow> unat i < unat (msgLength mi)
 2. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> ((unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)}) proof (prove)
goal (2 subgoals):
 1. \<And>s mi i s' y. \<lbrakk>cur_tcb' s; valid_ipc_buffer_ptr' y s; unat (msgLength mi) \<le> 120; (s, s') \<in> rf_sr; getMRs_rel args (Some y) s; n = unat i; unat i < length args; 4 \<le> unat i; buffer = Some y; {(args, s)} \<subseteq> fst (getMRs (ksCurThread s) (Some y) mi s)\<rbrakk> \<Longrightarrow> unat i < unat (msgLength mi)
 2. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> ((unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)}) proof (prove)
goal (2 subgoals):
 1. \<And>s mi i s' y. \<lbrakk>cur_tcb' s; valid_ipc_buffer_ptr' y s; unat (msgLength mi) \<le> 120; (s, s') \<in> rf_sr; getMRs_rel args (Some y) s; n = unat i; unat i < length args; 4 \<le> unat i; buffer = Some y; (args, s) \<in> fst (getMRs (ksCurThread s) (Some y) mi s)\<rbrakk> \<Longrightarrow> unat i < unat (msgLength mi)
 2. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> ((unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)}) proof (prove)
goal (3 subgoals):
 1. \<And>s mi i s' y. \<lbrakk>cur_tcb' s; valid_ipc_buffer_ptr' y s; unat (msgLength mi) \<le> 120; (s, s') \<in> rf_sr; getMRs_rel args (Some y) s; n = unat i; unat i < length args; 4 \<le> unat i; buffer = Some y\<rbrakk> \<Longrightarrow> msgLength mi \<le> msgMaxLength
 2. \<And>s mi i s' y. \<lbrakk>cur_tcb' s; valid_ipc_buffer_ptr' y s; unat (msgLength mi) \<le> 120; (s, s') \<in> rf_sr; getMRs_rel args (Some y) s; n = unat i; unat i < length args; 4 \<le> unat i; buffer = Some y; if Some y = None then length args = min (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (unat (msgLength mi)) else length args = unat (msgLength mi)\<rbrakk> \<Longrightarrow> unat i < unat (msgLength mi)
 3. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> ((unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)}) proof (prove)
goal (2 subgoals):
 1. \<And>s mi i s' y. \<lbrakk>cur_tcb' s; valid_ipc_buffer_ptr' y s; unat (msgLength mi) \<le> 120; (s, s') \<in> rf_sr; getMRs_rel args (Some y) s; n = unat i; unat i < length args; 4 \<le> unat i; buffer = Some y; if Some y = None then length args = min (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (unat (msgLength mi)) else length args = unat (msgLength mi)\<rbrakk> \<Longrightarrow> unat i < unat (msgLength mi)
 2. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> ((unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)}) proof (prove)
goal (1 subgoal):
 1. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> ((unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)}) proof (prove)
goal (1 subgoal):
 1. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args\<rbrakk> \<Longrightarrow> (unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi)) \<and> (\<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i) \<and> tcb_at' (ksCurThread s) s \<longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)} proof (prove)
goal (1 subgoal):
 1. \<And>s mi i s'. \<lbrakk>unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) < length args \<longrightarrow> (\<exists>y. buffer = Some y); cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; msgLength mi \<le> msgMaxLength; fst (getMRs (ksCurThread s) buffer mi s) = {(args, s)}; (s, s') \<in> rf_sr; getMRs_rel args buffer s; n = unat i; unat i < length args; unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> unat i < unat n_msgRegisters \<and> unat i < unat (msgLength mi); \<not> unat i < unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<longrightarrow> valid_ipc_buffer_ptr' (ptr_val (option_to_ptr buffer)) s \<and> i < msgLength mi \<and> SCAST(32 signed \<rightarrow> 32) n_msgRegisters \<le> i; tcb_at' (ksCurThread s) s\<rbrakk> \<Longrightarrow> fst ((do thread <- gets ksCurThread;
getMRs thread buffer mi
od) s) = {(args, s)} proof (prove)
goal:
No subgoals!