theory Ipc_C

lemma copyMRsFaultReply_ccorres_syscall:
  fixes word_size :: "'a::len"
  shows "ccorres dc xfdc
           (valid_pspace' and tcb_at' s
                          and tcb_at' r
                          and obj_at' (\<lambda>t. tcbFault t = Some f) r
                          and K (r \<noteq> s)
                          and K (len \<le> unat n_syscallMessage))
           (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace>
                 \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace>
                 \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall \<rbrace>
                 \<inter> \<lbrace>\<acute>length___unsigned_long = of_nat len \<rbrace>) hs
           (do t \<leftarrow> getSanitiseRegisterInfo r;
               a \<leftarrow> zipWithM_x (\<lambda>rs rd. do v \<leftarrow> asUser s (getRegister rs);
                                           asUser r (setRegister rd (ARM_H.sanitiseRegister t rd v))
                                        od)
               ARM_H.msgRegisters (take len ARM_H.syscallMessage);
               sendBuf \<leftarrow> lookupIPCBuffer False s;
               case sendBuf of None \<Rightarrow> return ()
                            | Some bufferPtr \<Rightarrow>
                                   zipWithM_x (\<lambda>i rd. do v \<leftarrow> loadWordUser (bufferPtr + i * 4);
                                                         asUser r (setRegister rd (ARM_H.sanitiseRegister t rd v))
                                                      od)
                                      [scast n_msgRegisters + 1.e.scast n_syscallMessage]
                                      (drop (unat (scast n_msgRegisters :: word32))
                                            (take len  ARM_H.syscallMessage))
            od)
           (Call copyMRsFaultReply_'proc)" proof - let ?obj_at_ft = "obj_at' (\<lambda>tcb. tcbFault tcb = Some f) s" note symb_exec_r_fault = ccorres_symb_exec_r_known_rv_UNIV
          [where xf'=ret__unsigned_' and R="?obj_at_ft" and R'=UNIV] show ?thesis apply (unfold K_def, rule ccorres_gen_asm) apply (cinit' lift: sender_' receiver_'
                        id___anonymous_enum_'
                        length___unsigned_long_'
                  simp: whileAnno_def) apply (ctac(no_vcg) add: Arch_getSanitiseRegisterInfo_ccorres) apply (rule ccorres_rhs_assoc2) apply (simp add: MessageID_Syscall_def) apply ccorres_rewrite apply (rule ccorres_split_nothrow_novcg) apply (rule ccorres_zipWithM_x_while) apply clarsimp apply (intro ccorres_rhs_assoc) apply (rule ccorres_symb_exec_r) apply ctac apply (rule ccorres_symb_exec_r) apply ctac apply vcg apply (rule conseqPre, vcg) apply fastforce apply wp apply vcg apply vcg apply (rule conjI, simp add: ARM_H.syscallMessage_def
                                           ARM.syscallMessage_def word_of_nat_less
                                           unat_of_nat msgRegisters_ccorres n_msgRegisters_def
                                           length_msgRegisters) apply (simp add: msgRegisters_ccorres n_msgRegisters_def length_msgRegisters unat_of_nat
                               syscallMessage_ccorres[symmetric,simplified MessageID_Syscall_def,simplified]
                               n_syscallMessage_def length_syscallMessage sanitiseRegister_def) apply (simp add: word_less_nat_alt unat_of_nat) apply (rule conseqPre, vcg) apply (clarsimp simp: word_of_nat_less syscallMessage_unfold length_msgRegisters
                                   n_syscallMessage_def n_msgRegisters_def) apply (simp add: min_def length_msgRegisters) apply (clarsimp simp:   min_def n_syscallMessage_def
                                    length_msgRegisters n_msgRegisters_def
                                    length_syscallMessage
                                    message_info_to_H_def word_of_nat_less
                             split: if_split) apply (simp add: word_less_nat_alt unat_of_nat not_le) apply clarsimp apply (vcg spec=TrueI) apply clarsimp apply wp apply simp+ apply (clarsimp simp: length_syscallMessage
                               length_msgRegisters
                               n_msgRegisters_def n_syscallMessage_def
                               word_bits_def min_def
                         split: if_split) apply ceqv apply (rule_tac P'="if 4 < len then _ else _" in ccorres_inst) apply (cases "4 < len" ; simp) apply (clarsimp simp: unat_ucast_less_no_overflow n_syscallMessage_def
                              length_syscallMessage msgRegisters_unfold
                              word_of_nat_less unat_of_nat unat_less_helper) apply ccorres_rewrite apply (ctac(no_vcg)) apply (rename_tac sb sb') apply wpc apply (simp add: option_to_0_def ccorres_cond_iffs option_to_ptr_def) apply (rule ccorres_return_Skip') apply (rule_tac P="sb \<noteq> Some 0" in ccorres_gen_asm) apply (rule_tac P="case_option True (\<lambda>x. is_aligned x msg_align_bits) sb"
                            in ccorres_gen_asm) apply (simp add: option_to_0_def option_to_ptr_def) apply (subgoal_tac "sb'\<noteq> NULL") prefer 2 apply clarsimp apply (simp add: ccorres_cond_iffs) apply (subst ccorres_seq_skip' [symmetric]) apply (rule_tac r'="\<lambda>rv rv'. rv' = of_nat (unat  n_msgRegisters) + _" in ccorres_rel_imp) apply (drule_tac s="sb" in sym) apply (simp only: zipWithM_x_mapM_x) apply ccorres_rewrite apply (rule_tac F="\<lambda>_. valid_pspace'
                                     and (case sb of None \<Rightarrow> \<top>
                                                   | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)
                                     and tcb_at' r"
                             in ccorres_mapM_x_while') apply clarsimp apply (rule ccorres_guard_imp2) apply (rule ccorres_pre_loadWordUser) apply (intro ccorres_rhs_assoc) apply (rule ccorres_symb_exec_r) apply (rule ccorres_move_array_assertion_ipc_buffer
                                ccorres_Guard_Seq[where S="{s. h_t_valid (htd s) c_guard (ptr s)}" for ptr htd])+ apply (rule ccorres_symb_exec_r) apply (rule ccorres_symb_exec_r) apply ctac apply vcg apply (rule conseqPre, vcg) apply fastforce apply vcg apply (rule conseqPre, vcg) apply clarsimp apply vcg apply (rule conseqPre, vcg) apply clarsimp apply clarsimp apply (subst aligned_add_aligned, assumption) apply (rule is_aligned_mult_triv2[where n=2, simplified]) apply (simp add: msg_align_bits) apply (simp only: n_msgRegisters_def) apply (clarsimp simp: n_syscallMessage_def n_msgRegisters_def
                                       word_unat.Rep_inverse[of "scast _ :: 'a word"]
                                       msgRegisters_ccorres[symmetric]
                                       length_msgRegisters[symmetric]
                                       syscallMessage_ccorres[symmetric]
                                       length_msgRegisters length_syscallMessage
                                       syscallMessage_ccorres[symmetric, simplified MessageID_Syscall_def, simplified]
                                       unat_of_nat32 word_bits_def
                                       MessageID_Syscall_def
                                       min_def message_info_to_H_def
                                       upto_enum_def typ_heap_simps'
                                       unat_add_lem[THEN iffD1]
                                       msg_align_bits sanitiseRegister_def
                             simp del: upt_rec_numeral,
                        simp_all add: word_less_nat_alt unat_add_lem[THEN iffD1] unat_of_nat)[1] apply (clarsimp simp: n_syscallMessage_def n_msgRegisters_def
                                      msgRegisters_ccorres
                                      syscallMessage_ccorres
                                      length_syscallMessage length_msgRegisters
                                      message_info_to_H_def min_def
                               split: if_split) apply (fastforce dest!: le_antisym) apply (vcg spec=TrueI) apply clarsimp apply (simp add: split_def) apply (wp hoare_case_option_wp) apply (fastforce elim: aligned_add_aligned
                               intro: is_aligned_mult_triv2 [where n=2,simplified]
                               simp: word_bits_def msg_align_bits) apply (clarsimp simp: msgRegisters_unfold
                                   n_msgRegisters_def
                                   word_bits_def not_less) apply (simp add: n_syscallMessage_def) apply simp apply (subst option.split[symmetric,where P=id, simplified]) apply (rule valid_drop_case) apply (wp hoare_drop_imps hoare_vcg_all_lift lookupIPCBuffer_aligned[simplified]
                  lookupIPCBuffer_not_Some_0[simplified]) apply (simp add: length_syscallMessage
                        length_msgRegisters
                        n_syscallMessage_def
                        msgMaxLength_def
                        n_msgRegisters_def
                        of_nat_less_iff) apply (rule_tac P'="{s. i_' s = of_nat len}" in ccorres_inst) apply ccorres_rewrite apply (rule ccorres_guard_imp) apply (rule ccorres_symb_exec_l) apply (case_tac rva; clarsimp) apply (rule ccorres_return_Skip)+ apply (wp mapM_x_wp_inv user_getreg_inv'
                       | clarsimp simp: zipWithM_x_mapM_x split: prod.split)+ apply (cases  "4 < len") apply ((fastforce simp: guard_is_UNIV_def
                            msgRegisters_unfold
                            syscallMessage_unfold
                            n_syscallMessage_def
                            n_msgRegisters_def
                       intro: obj_tcb_at')+)[2] apply wpsimp+ done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and K (r \<noteq> s) and K (len \<le> unat n_syscallMessage)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat len\<rbrace>) hs (do t <- local.getSanitiseRegisterInfo r;
a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (Call copyMRsFaultReply_'proc) proof (state)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and K (r \<noteq> s) and K (len \<le> unat n_syscallMessage)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat len\<rbrace>) hs (do t <- local.getSanitiseRegisterInfo r;
a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (Call copyMRsFaultReply_'proc) proof (state)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and K (r \<noteq> s) and K (len \<le> unat n_syscallMessage)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat len\<rbrace>) hs (do t <- local.getSanitiseRegisterInfo r;
a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (Call copyMRsFaultReply_'proc) proof (state)
this:
\<lbrakk>\<And>sa. ?\<Gamma>\<turnstile> (UNIV \<inter> {s'. obj_at' (\<lambda>tcb. tcbFault tcb = Some f) s sa \<and> (sa, s') \<in> ?sr}) ?m ({s'. (sa, s') \<in> ?sr} \<inter> \<lbrace>\<acute>ret__unsigned = ?val\<rbrace>); \<And>rv' t t'. ceqv ?\<Gamma> ret__unsigned_' rv' t t' ?y (?y' rv'); ccorres_underlying ?sr ?\<Gamma> ?r ?xf ?arrel ?axf ?P ?Q ?hs ?a (?y' ?val); guard_is_UNIV (\<lambda>rv rv'. rv' = ?val) ret__unsigned_' (\<lambda>rv rv'. ?Q)\<rbrakk> \<Longrightarrow> ccorres_underlying ?sr ?\<Gamma> ?r ?xf ?arrel ?axf (?P and obj_at' (\<lambda>tcb. tcbFault tcb = Some f) s) UNIV ?hs ?a (?m;;
?y)

goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and K (r \<noteq> s) and K (len \<le> unat n_syscallMessage)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat len\<rbrace>) hs (do t <- local.getSanitiseRegisterInfo r;
a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (Call copyMRsFaultReply_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and K (r \<noteq> s) and K (len \<le> unat n_syscallMessage)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat len\<rbrace>) hs (do t <- local.getSanitiseRegisterInfo r;
a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (Call copyMRsFaultReply_'proc) proof (prove)
goal (1 subgoal):
 1. len \<le> unat n_syscallMessage \<Longrightarrow> ccorres dc xfdc (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat len\<rbrace>) hs (do t <- local.getSanitiseRegisterInfo r;
a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (Call copyMRsFaultReply_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1923 length___unsigned_long id___anonymous_enum receiver sender) (?Q'1923 length___unsigned_long id___anonymous_enum receiver sender) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(receiver);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < (if length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i])));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(sender,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,\<acute>v,\<acute>archInfo);;
CALL setRegister_'proc(receiver,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
IF \<acute>i < length___unsigned_long THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,sender);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < length___unsigned_long\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i])));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,\<acute>v,\<acute>archInfo);;
CALL setRegister_'proc(receiver,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI)))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1923 length___unsigned_long id___anonymous_enum receiver sender sa \<and> s' \<in> ?Q'1923 length___unsigned_long id___anonymous_enum receiver sender proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; ((=) \<circ> from_bool) rv archInfo\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1931 length___unsigned_long id___anonymous_enum receiver sender rv) (?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) (SKIP # hs) (do a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < (if length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i])));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(sender,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,\<acute>v,archInfo);;
CALL setRegister_'proc(receiver,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
IF \<acute>i < length___unsigned_long THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,sender);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < length___unsigned_long\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i])));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,\<acute>v,archInfo);;
CALL setRegister_'proc(receiver,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>?Q1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv (ret__unsigned_long_' t)} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; ((=) \<circ> from_bool) rv archInfo\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1931 length___unsigned_long id___anonymous_enum receiver sender rv) (?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) (SKIP # hs) (do a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < (if length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i])));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(sender,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,\<acute>v,archInfo);;
CALL setRegister_'proc(receiver,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
IF \<acute>i < length___unsigned_long THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,sender);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < length___unsigned_long\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i])));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,\<acute>v,archInfo);;
CALL setRegister_'proc(receiver,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>?Q1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv (ret__unsigned_long_' t)} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1931 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv) (?Q'1931 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo) (SKIP # hs) (do a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds UNIV (Guard ArrayBounds UNIV (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i])));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds UNIV (Guard ArrayBounds UNIV (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i])));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>?Q1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv (ret__unsigned_long_' t)} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1931 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv) (?Q'1931 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo) (SKIP # hs) (do a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>?Q1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv (ret__unsigned_long_' t)} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ccorres (?r'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) (?xf'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) (?P3105 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv) (?Q'1931 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo) [] (zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage)) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; ?r'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) (?xf'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. ?P3105 length___unsigned_long id___anonymous_enum receiver sender a and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv (ret__unsigned_long_' t)} proof (prove)
goal (11 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>n. n < length TCB_H.msgRegisters \<and> n < length (take len FaultHandler_H.syscallMessage) \<longrightarrow> ccorres dc xfdc (?F3115 rv n) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>?F3115 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. ?F3115 rv (Suc n)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. ?P3105 length___unsigned_long id___anonymous_enum receiver sender a and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv. ?F3115 rv 0 \<equiv>\<^sup>? ?P3105 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) proof (prove)
goal (11 subgoals):
 1. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?F3115 rv n) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) v))
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>?F3115 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. ?F3115 rv (Suc n)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. ?P3105 length___unsigned_long id___anonymous_enum receiver sender a and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv. ?F3115 rv 0 \<equiv>\<^sup>? ?P3105 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) proof (prove)
goal (11 subgoals):
 1. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?F3115 rv n) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) v))
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
(Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
(\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>?F3115 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. ?F3115 rv (Suc n)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. ?P3105 length___unsigned_long id___anonymous_enum receiver sender a and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv. ?F3115 rv 0 \<equiv>\<^sup>? ?P3105 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) proof (prove)
goal (13 subgoals):
 1. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?F3115 rv n) (?Q'3137 rv n) [] (do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) v))
od) (Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
(\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long)))
 2. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) (?Q'3137 rv n)
 3. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ?F3115 rv n s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>?F3115 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. ?F3115 rv (Suc n)\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>rv. ?F3115 rv 0 \<equiv>\<^sup>? ?P3105 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) proof (prove)
goal (15 subgoals):
 1. \<And>rv n rva v. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; rva = v\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3144 rv n rva) (?Q'3144 rv n rva v) [] (asUser r (setRegister (FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) rva))) (\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,v);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<lbrace>?R3144 rv n\<rbrace> asUser s (getRegister (TCB_H.msgRegisters ! n)) \<lbrace>?Q3144 rv n\<rbrace>
 3. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3144 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> ?Q'3144 rv n rva (v_' s)}
 4. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3144 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 5. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ((\<lambda>_. True) and ?R3144 rv n) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and ?R3144 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and ?R3144 rv (Suc n)\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
A total of 15 subgoals...
flex-flex pairs:
?R3149 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>rv. ?R3144 rv 0 proof (prove)
goal (17 subgoals):
 1. \<And>rv n rva v. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; rva = v\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3144 rv n rva) (?Q'3236 rv n rva v) [] (asUser r (setRegister (FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) rva))) (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>rv n rva v. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; rva = v\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3144 rv n rva v) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,v) (?Q'3236 rv n rva v)
 3. \<And>rv n rva v s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; rva = v; ?Q3144 rv n rva s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3144 rv n rva v \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,v) {s'. (s, s') \<in> rf_sr}
 4. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<lbrace>?R3144 rv n\<rbrace> asUser s (getRegister (TCB_H.msgRegisters ! n)) \<lbrace>?Q3144 rv n\<rbrace>
 5. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3144 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> ?Q'3144 rv n rva (v_' s)}
 6. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3144 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 7. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ((\<lambda>_. True) and ?R3144 rv n) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and ?R3144 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and ?R3144 rv (Suc n)\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
?R3149 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>rv. ?R3144 rv 0 proof (prove)
goal (16 subgoals):
 1. \<And>rv n rva v. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; rva = v\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3144 rv n rva v) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,v) {s. w_'_update (\<lambda>_. ret__unsigned_long_' s) (reg_'_update (\<lambda>_. r_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr r) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! n)\<rbrace> \<inter> \<lbrace>\<acute>w = local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) rva\<rbrace>}
 2. \<And>rv n rva v s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; rva = v; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3144 rv n rva v \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,v) {s'. (s, s') \<in> rf_sr}
 3. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<lbrace>?R3144 rv n\<rbrace> asUser s (getRegister (TCB_H.msgRegisters ! n)) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3144 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> ?Q'3144 rv n rva (v_' s)}
 5. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3144 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 6. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ((\<lambda>_. True) and ?R3144 rv n) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and ?R3144 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and ?R3144 rv (Suc n)\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
A total of 16 subgoals...
flex-flex pairs:
?R3149 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>rv. ?R3144 rv 0 proof (prove)
goal (15 subgoals):
 1. \<And>rv n rva v s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; rva = v; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra v \<longrightarrow> \<acute>r = register_from_H (FaultHandler_H.syscallMessage ! n) \<and> local.sanitiseRegister t ra v = local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) rva)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,v) {s'. (s, s') \<in> rf_sr}
 2. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<lbrace>?R3144 rv n\<rbrace> asUser s (getRegister (TCB_H.msgRegisters ! n)) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3144 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra \<^bsup>s\<^esup>v \<longrightarrow> \<acute>r = register_from_H (FaultHandler_H.syscallMessage ! n) \<and> local.sanitiseRegister t ra \<^bsup>s\<^esup>v = local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) rva)\<rbrace>}
 4. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3144 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 5. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ((\<lambda>_. True) and ?R3144 rv n) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and ?R3144 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and ?R3144 rv (Suc n)\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
A total of 15 subgoals...
flex-flex pairs:
?R3149 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>rv. ?R3144 rv 0 proof (prove)
goal (15 subgoals):
 1. \<And>rv n rva v s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; rva = v; True\<rbrakk> \<Longrightarrow> \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra v \<longrightarrow> \<acute>r = register_from_H (FaultHandler_H.syscallMessage ! n) \<and> local.sanitiseRegister t ra v = local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) rva)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<exists>t r. r_' sa = register_from_H r \<and> (\<forall>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r v \<longrightarrow> (s, sa\<lparr>ret__unsigned_long_' := local.sanitiseRegister t r v\<rparr>) \<in> rf_sr)}
 2. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<lbrace>?R3144 rv n\<rbrace> asUser s (getRegister (TCB_H.msgRegisters ! n)) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3144 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra \<^bsup>s\<^esup>v \<longrightarrow> \<acute>r = register_from_H (FaultHandler_H.syscallMessage ! n) \<and> local.sanitiseRegister t ra \<^bsup>s\<^esup>v = local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) rva)\<rbrace>}
 4. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3144 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 5. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ((\<lambda>_. True) and ?R3144 rv n) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and ?R3144 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and ?R3144 rv (Suc n)\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
A total of 15 subgoals...
flex-flex pairs:
?R3149 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>rv. ?R3144 rv 0 proof (prove)
goal (14 subgoals):
 1. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<lbrace>?R3144 rv n\<rbrace> asUser s (getRegister (TCB_H.msgRegisters ! n)) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3144 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra \<^bsup>s\<^esup>v \<longrightarrow> \<acute>r = register_from_H (FaultHandler_H.syscallMessage ! n) \<and> local.sanitiseRegister t ra \<^bsup>s\<^esup>v = local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) rva)\<rbrace>}
 3. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3144 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 4. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ((\<lambda>_. True) and ?R3144 rv n) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and ?R3144 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and ?R3144 rv (Suc n)\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
A total of 14 subgoals...
flex-flex pairs:
?R3149 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>rv. ?R3144 rv 0 proof (prove)
goal (13 subgoals):
 1. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3144 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra \<^bsup>s\<^esup>v \<longrightarrow> \<acute>r = register_from_H (FaultHandler_H.syscallMessage ! n) \<and> local.sanitiseRegister t ra \<^bsup>s\<^esup>v = local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) rva)\<rbrace>}
 2. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3144 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 3. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv n. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> {sa. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr s \<longrightarrow> (\<exists>t r. r_' sa = register_from_H r \<and> (\<forall>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat (i_' sa)])]) \<longrightarrow> r_' sa = register_from_H (FaultHandler_H.syscallMessage ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat (i_' sa)])]) = local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat (i_' sa)])])))} \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 2. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv n t_hrs i. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; i = word_of_nat n\<rbrakk> \<Longrightarrow> i < 0xC \<and> kernel_all_global_addresses.msgRegisters.[unat i] = register_from_H (TCB_H.msgRegisters ! n) \<and> (kernel_all_global_addresses.msgRegisters.[unat i] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr s \<longrightarrow> (\<exists>t r. kernel_all_global_addresses.fault_messages.[0].[unat i] = register_from_H r \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = local.sanitiseRegister t r (h_val (hrs_mem t_hrs) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])]) \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat i] = register_from_H (FaultHandler_H.syscallMessage ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem t_hrs) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])]) = local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) (h_val (hrs_mem t_hrs) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])])))) \<and> i < 4
 2. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv n t_hrs i. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; i = word_of_nat n\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.msgRegisters.[unat i] = register_from_H (TCB_H.msgRegisters ! n) \<and> (kernel_all_global_addresses.msgRegisters.[unat i] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr s \<longrightarrow> (\<exists>t r. kernel_all_global_addresses.fault_messages.[0].[unat i] = register_from_H r \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = local.sanitiseRegister t r (h_val (hrs_mem t_hrs) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])]) \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat i] = register_from_H (FaultHandler_H.syscallMessage ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem t_hrs) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])]) = local.sanitiseRegister rv (FaultHandler_H.syscallMessage ! n) (h_val (hrs_mem t_hrs) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])])))) \<and> i < 4
 2. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n i. \<lbrakk>len \<le> 12; n < 4; n < len; i = word_of_nat n\<rbrakk> \<Longrightarrow> word_of_nat n < 4
 2. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv n s. \<lbrakk>len \<le> unat n_syscallMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.syscallMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. i_' sa < 0xC \<and> (s, r_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[0].[unat (i_' sa)]) sa) \<in> rf_sr}
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (if unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> (if length FaultHandler_H.syscallMessage \<le> len then length FaultHandler_H.syscallMessage else len) then unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) else if length FaultHandler_H.syscallMessage \<le> len then length FaultHandler_H.syscallMessage else len))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>n. \<lbrakk>len \<le> 12; len \<noteq> 12; 4 \<le> len; word_of_nat len < 4\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < 4)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>rv sa. \<lbrakk>len \<le> unat n_syscallMessage; i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>t_hrs i. \<lbrakk>len \<le> unat n_syscallMessage; i < word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len))\<rbrakk> \<Longrightarrow> i < 0xC \<longrightarrow> i < 4 \<longrightarrow> kernel_all_global_addresses.msgRegisters.[unat i] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr s \<longrightarrow> (kernel_all_global_addresses.fault_messages.[0].[unat i] = SCAST(32 signed \<rightarrow> 32) Kernel_C.CPSR \<longrightarrow> 0 \<le>s 8 \<longrightarrow> unat 1 * 2 ^ unat 8 < 2 ^ 31 \<and> 0 \<le>s 1 \<longrightarrow> 0 \<le>s 6 \<longrightarrow> unat 1 * 2 ^ unat 6 < 2 ^ 31 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.CPSR < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr r \<longrightarrow> i = i) \<and> (kernel_all_global_addresses.fault_messages.[0].[unat i] \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.CPSR \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat i] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr r \<longrightarrow> i = i)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.syscallMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.syscallMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.syscallMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)) < 2 ^ word_bits
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len) < 2 ^ word_bits
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (?d'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (IF rv' < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (?Q'3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a) (if 4 < len then ?uu3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv') (SKIP # hs) (do sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (IF rv' < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then ?uu3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uu3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then ?uu3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()) (?uu3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond UNIV (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then ?uu3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()) (?uu3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>?Q3096 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then ?uu3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>rv rva sendBuf. \<lbrakk>len \<le> 12; 4 < len; ((=) \<circ> option_to_ptr) rva sendBuf\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3992 rv rva) (?Q'3992 rv rva sendBuf) (SKIP # hs) (case rva of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (IF sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,\<acute>v);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>?Q3992 rv\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'3999 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?Q'3999 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?Q'3992 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (7 subgoals):
 1. \<And>rv sb sb'. \<lbrakk>len \<le> 12; 4 < len; ((=) \<circ> option_to_ptr) sb sb'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3992 rv sb) (?Q'3992 rv sb sb') (SKIP # hs) (case sb of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (IF sb' \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,\<acute>v);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>?Q3992 rv\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'3999 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?Q'3999 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?Q'3992 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>rv sb sb'. \<lbrakk>len \<le> 12; 4 < len; ((=) \<circ> option_to_ptr) sb sb'; sb = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4176 rv sb) (?R''4163 rv sb sb') (SKIP # hs) (return ()) (IF sb' \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,\<acute>v);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; ((=) \<circ> option_to_ptr) sb sb'; sb = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R4175 rv sb a x2) (?R''4162 rv sb sb' x2) (SKIP # hs) (zipWithM_x (\<lambda>i rd. do v <- loadWordUser (x2 + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (IF sb' \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,\<acute>v);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI)
 3. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a b. (a = None \<longrightarrow> ?R4176 rv a b) \<and> (\<forall>x. a = Some x \<longrightarrow> ?R4175 rv a b x)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> ?R''4174 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?R''4174 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4163 rv rva (ret__ptr_to_unsigned_long_' t)
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>rv sb sb'. \<lbrakk>len \<le> 12; 4 < len; NULL = sb'; sb = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4176 rv None) (?R''4163 rv None sb') (SKIP # hs) (return ()) SKIP
 2. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; ((=) \<circ> option_to_ptr) sb sb'; sb = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R4175 rv sb a x2) (?R''4162 rv sb sb' x2) (SKIP # hs) (zipWithM_x (\<lambda>i rd. do v <- loadWordUser (x2 + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (IF sb' \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,\<acute>v);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI)
 3. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a b. (a = None \<longrightarrow> ?R4176 rv a b) \<and> (\<forall>x. a = Some x \<longrightarrow> ?R4175 rv a b x)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> ?R''4174 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?R''4174 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4163 rv rva (ret__ptr_to_unsigned_long_' t)
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (7 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; ((=) \<circ> option_to_ptr) sb sb'; sb = Some x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R4175 rv sb a x2) (?R''4162 rv sb sb' x2) (SKIP # hs) (zipWithM_x (\<lambda>i rd. do v <- loadWordUser (x2 + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (IF sb' \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,\<acute>v);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> ?R4175 rv a b x)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (7 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; ((=) \<circ> option_to_ptr) sb sb'; sb = Some x2; sb \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G4192 rv sb x2) (?R''4162 rv sb sb' x2) (SKIP # hs) (zipWithM_x (\<lambda>i rd. do v <- loadWordUser (x2 + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (IF sb' \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,\<acute>v);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a b. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (?G4192 rv a x and (\<lambda>_. a \<noteq> Some 0)) b)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (7 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; ((=) \<circ> option_to_ptr) sb sb'; sb = Some x2; sb \<noteq> Some 0; case sb of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G4196 rv sb x2) (?R''4162 rv sb sb' x2) (SKIP # hs) (zipWithM_x (\<lambda>i rd. do v <- loadWordUser (x2 + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (IF sb' \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,\<acute>v);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (?G4196 rv a x and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (7 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G4196 rv (Some x2) x2) (?R''4162 rv (Some x2) sb' x2) (SKIP # hs) (zipWithM_x (\<lambda>i rd. do v <- loadWordUser (x2 + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (Cond (if sb' \<noteq> NULL then UNIV else {}) (While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)) SKIP)
 2. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (?G4196 rv a x and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G4196 rv (Some x2) x2) (?R''4162 rv (Some x2) sb' x2) (SKIP # hs) (zipWithM_x (\<lambda>i rd. do v <- loadWordUser (x2 + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (Cond (if sb' \<noteq> NULL then UNIV else {}) (While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)) SKIP)
 2. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits\<rbrakk> \<Longrightarrow> sb' \<noteq> NULL
 3. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (?G4196 rv a x and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits\<rbrakk> \<Longrightarrow> sb' \<noteq> NULL
 2. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G4196 rv (Some x2) x2) (?R''4162 rv (Some x2) sb' x2) (SKIP # hs) (zipWithM_x (\<lambda>i rd. do v <- loadWordUser (x2 + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (Cond (if sb' \<noteq> NULL then UNIV else {}) (While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)) SKIP)
 3. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (?G4196 rv a x and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (7 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G4196 rv (Some x2) x2) (?R''4162 rv (Some x2) sb' x2) (SKIP # hs) (zipWithM_x (\<lambda>i rd. do v <- loadWordUser (x2 + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (Cond (if sb' \<noteq> NULL then UNIV else {}) (While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)) SKIP)
 2. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (?G4196 rv a x and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (7 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G4196 rv (Some x2) x2) (?R''4162 rv (Some x2) sb' x2) (SKIP # hs) (zipWithM_x (\<lambda>i rd. do v <- loadWordUser (x2 + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1))
 2. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (?G4196 rv a x and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (7 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G4213 rv rv x2 (Some x2) x2) (?R''4214 rv rv sb' x2 (Some x2) sb' x2) (SKIP # hs) (zipWithM_x (\<lambda>i rd. do v <- loadWordUser (x2 + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
SKIP)
 2. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (?G4196 rv a x and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv sb' x2. ?R''4214 rv rv sb' x2 (Some x2) sb' x2 \<equiv>\<^sup>? \<lambda>rv sb' x2. ?R''4162 rv (Some x2) sb' x2
\<lambda>rv x2. ?G4213 rv rv x2 (Some x2) x2 \<equiv>\<^sup>? \<lambda>rv x2. ?G4196 rv (Some x2) x2
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rva rv'. rv' = of_nat (unat n_msgRegisters) + ?uu4221 rv sb sb' x2) (?xf'4216 rv sb sb' x2) (?G4213 rv rv x2 (Some x2) x2) (?R''4214 rv rv sb' x2 (Some x2) sb' x2) (SKIP # hs) (zipWithM_x (\<lambda>i rd. do v <- loadWordUser (x2 + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
SKIP)
 2. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; ?xf'4216 rv sb sb' x2 y = of_nat (unat n_msgRegisters) + ?uu4221 rv sb sb' x2\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 3. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (?G4196 rv a x and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv sb' x2. ?R''4214 rv rv sb' x2 (Some x2) sb' x2 \<equiv>\<^sup>? \<lambda>rv sb' x2. ?R''4162 rv (Some x2) sb' x2
\<lambda>rv x2. ?G4213 rv rv x2 (Some x2) x2 \<equiv>\<^sup>? \<lambda>rv x2. ?G4196 rv (Some x2) x2
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rva rv'. rv' = of_nat (unat n_msgRegisters) + ?uu4221 rv sb sb' x2) (?xf'4216 rv sb sb' x2) (?G4213 rv rv x2 (Some x2) x2) (?R''4214 rv rv sb' x2 (Some x2) sb' x2) (SKIP # hs) (zipWithM_x (\<lambda>i rd. do v <- loadWordUser (x2 + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) (While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
SKIP)
 2. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; ?xf'4216 rv sb sb' x2 y = of_nat (unat n_msgRegisters) + ?uu4221 rv sb sb' x2\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 3. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (?G4196 rv a x and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv sb' x2. ?R''4214 rv rv sb' x2 (Some x2) sb' x2 \<equiv>\<^sup>? \<lambda>rv sb' x2. ?R''4162 rv (Some x2) sb' x2
\<lambda>rv x2. ?G4213 rv rv x2 (Some x2) x2 \<equiv>\<^sup>? \<lambda>rv x2. ?G4196 rv (Some x2) x2
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rva rv'. rv' = of_nat (unat n_msgRegisters) + ?uu4221 rv sb sb' x2) (?xf'4216 rv sb sb' x2) (?G4213 rv rv x2 sb x2) (?R''4214 rv rv sb' x2 sb sb' x2) (SKIP # hs) (mapM_x (\<lambda>(x, y). do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od) (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
SKIP)
 2. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; ?xf'4216 rv sb sb' x2 y = of_nat (unat n_msgRegisters) + ?uu4221 rv sb sb' x2\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 3. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (?G4196 rv a x and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv sb' x2. ?R''4214 rv rv sb' x2 (Some x2) sb' x2 \<equiv>\<^sup>? \<lambda>rv sb' x2. ?R''4162 rv (Some x2) sb' x2
\<lambda>rv x2. ?G4213 rv rv x2 (Some x2) x2 \<equiv>\<^sup>? \<lambda>rv x2. ?G4196 rv (Some x2) x2
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (8 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = of_nat (unat n_msgRegisters) + ?uu4221 rv sb sb' x2) (?xf'4216 rv sb sb' x2) (?G4229 rv rv sb x2 x2) (?R''4230 rv rv sb sb' sb' x2 x2) (SKIP # hs) (mapM_x (\<lambda>(x, y). do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od) (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1))
 2. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; ?xf'4216 rv sb sb' x2 y = of_nat (unat n_msgRegisters) + ?uu4221 rv sb sb' x2\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 3. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (?G4196 rv a x and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rva. ((=) \<circ> option_to_ptr) rva (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rva = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rva = Some x \<longrightarrow> s \<in> ?R''4173 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv' t rva x}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv sb' x2. ?R''4230 rv rv (Some x2) sb' sb' x2 x2 \<equiv>\<^sup>? \<lambda>rv sb' x2. ?R''4162 rv (Some x2) sb' x2
\<lambda>rv x2. ?G4229 rv rv (Some x2) x2 x2 \<equiv>\<^sup>? \<lambda>rv x2. ?G4196 rv (Some x2) x2
\<lambda>rv. ?R''4173 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () 4 \<equiv>\<^sup>? \<lambda>rv t rva. ?R''4162 rv rva (ret__ptr_to_unsigned_long_' t) proof (prove)
goal (12 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>n<length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))). ccorres dc xfdc (valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r) \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters) + word_of_nat n\<rbrace> (SKIP # hs) (case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 3. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 5. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 6. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv x2 n. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace> (SKIP # hs) (do v <- loadWordUser (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4);
asUser r (setRegister (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) (local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) v))
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 3. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 5. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 6. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv x2 n. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4671 rv x2 n) (?Q'4671 rv x2 n) (SKIP # hs) (do v <- loadWordUser (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4);
asUser r (setRegister (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) (local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) v))
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q4671 rv x2 n s \<and> s' \<in> ?Q'4671 rv x2 n
 3. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 4. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 6. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 7. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4674 rv x2 n rva) (?Q4674 rv x2 n rva) (SKIP # hs) (asUser r (setRegister (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) (local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva))) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> ?P4674 rv x2 n v s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> ?Q4674 rv x2 n v}
 3. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 4. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 6. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 7. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4674 rv x2 n rva) (?Q4674 rv x2 n rva) (SKIP # hs) (asUser r (setRegister (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) (local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva))) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
(Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))));;
(\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))))
 2. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> ?P4674 rv x2 n v s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> ?Q4674 rv x2 n v}
 3. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 4. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 6. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 7. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4674 rv x2 n rva) (?Q'4678 rv x2 n rva) (SKIP # hs) (asUser r (setRegister (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) (local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva))) (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))));;
(\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long)))
 2. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) (?Q'4678 rv x2 n rva)
 3. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); ?P4674 rv x2 n rva s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 4. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> ?P4674 rv x2 n v s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> ?Q4674 rv x2 n v}
 5. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 6. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 8. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 9. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A4690 rv x2 n rva) (?C'4690 rv x2 n rva) (SKIP # hs) (asUser r (setRegister (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) (local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva))) (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)));;
(\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long)))
 2. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) (?C'4690 rv x2 n rva \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>)
 3. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (?A4690 rv x2 n rva and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 4. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> (?A4690 rv x2 n v and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> ?Q4674 rv x2 n v}
 5. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 6. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 8. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 9. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A4690 rv x2 n rva) (?Q'4692 rv x2 n rva) (SKIP # hs) (asUser r (setRegister (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) (local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva))) (\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'4690 rv x2 n rva) \<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) (?Q'4692 rv x2 n rva)
 3. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); ?A4690 rv x2 n rva s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'4690 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) {s'. (s, s') \<in> rf_sr}
 4. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) (?C'4690 rv x2 n rva \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>)
 5. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (?A4690 rv x2 n rva and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 6. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> (?A4690 rv x2 n v and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> ?Q4674 rv x2 n v}
 7. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 8. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 10. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
A total of 17 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A4690 rv x2 n rva) (?Q'4696 rv x2 n rva) (SKIP # hs) (asUser r (setRegister (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) (local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva))) (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4692 rv x2 n rva) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv) (?Q'4696 rv x2 n rva)
 3. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); ?A4690 rv x2 n rva s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4692 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv) {s'. (s, s') \<in> rf_sr}
 4. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'4690 rv x2 n rva) \<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) (?Q'4692 rv x2 n rva)
 5. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); ?A4690 rv x2 n rva s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'4690 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) {s'. (s, s') \<in> rf_sr}
 6. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) (?C'4690 rv x2 n rva \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>)
 7. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (?A4690 rv x2 n rva and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 8. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> (?A4690 rv x2 n v and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> ?Q4674 rv x2 n v}
 9. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 10. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4692 rv x2 n rva) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv) {s. w_'_update (\<lambda>_. ret__unsigned_long_' s) (reg_'_update (\<lambda>_. r_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr r) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n)\<rbrace> \<inter> \<lbrace>\<acute>w = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva\<rbrace>}
 2. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4692 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv) {s'. (s, s') \<in> rf_sr}
 3. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'4690 rv x2 n rva) \<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) (?Q'4692 rv x2 n rva)
 4. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'4690 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) {s'. (s, s') \<in> rf_sr}
 5. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) (?C'4690 rv x2 n rva \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>)
 6. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 7. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> ?Q4674 rv x2 n v}
 8. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 9. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 10. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra \<acute>v \<longrightarrow> \<acute>r = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t ra \<acute>v = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv) {s'. (s, s') \<in> rf_sr}
 2. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'4690 rv x2 n rva) \<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra \<acute>v \<longrightarrow> \<acute>r = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t ra \<acute>v = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva)\<rbrace>
 3. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'4690 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) {s'. (s, s') \<in> rf_sr}
 4. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) (?C'4690 rv x2 n rva \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>)
 5. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 6. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> ?Q4674 rv x2 n v}
 7. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 8. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 10. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); True\<rbrakk> \<Longrightarrow> \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra \<acute>v \<longrightarrow> \<acute>r = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t ra \<acute>v = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<exists>t r. r_' sa = register_from_H r \<and> (\<forall>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r (v_' sa) \<longrightarrow> (s, sa\<lparr>ret__unsigned_long_' := local.sanitiseRegister t r (v_' sa)\<rparr>) \<in> rf_sr)}
 2. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'4690 rv x2 n rva) \<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra \<acute>v \<longrightarrow> \<acute>r = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t ra \<acute>v = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva)\<rbrace>
 3. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'4690 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) {s'. (s, s') \<in> rf_sr}
 4. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) (?C'4690 rv x2 n rva \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>)
 5. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 6. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> ?Q4674 rv x2 n v}
 7. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 8. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 10. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'4690 rv x2 n rva) \<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra \<acute>v \<longrightarrow> \<acute>r = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t ra \<acute>v = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva)\<rbrace>
 2. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'4690 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) {s'. (s, s') \<in> rf_sr}
 3. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) (?C'4690 rv x2 n rva \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>)
 4. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 5. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> ?Q4674 rv x2 n v}
 6. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 7. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 9. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 10. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))) \<longrightarrow> \<acute>r = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t ra (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>v :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) {s'. (s, s') \<in> rf_sr}
 2. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) (\<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))) \<longrightarrow> \<acute>r = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t ra (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva)\<rbrace> \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>)
 3. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 4. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> ?Q4674 rv x2 n v}
 5. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 6. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 8. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 9. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); True\<rbrakk> \<Longrightarrow> \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))) \<longrightarrow> \<acute>r = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t ra (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, v_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) (x2 + (i_' sa * 4 + 4)))) sa) \<in> rf_sr}
 2. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) (\<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))) \<longrightarrow> \<acute>r = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t ra (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva)\<rbrace> \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>)
 3. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 4. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> ?Q4674 rv x2 n v}
 5. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 6. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 8. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 9. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv x2 n rva. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) (\<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))) \<longrightarrow> \<acute>r = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t ra (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva)\<rbrace> \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>)
 2. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q4674 rv x2 n rva \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 3. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> ?Q4674 rv x2 n v}
 4. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 5. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 7. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 8. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 9. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. i_' s < 0xC \<and> (\<exists>t r. kernel_all_global_addresses.fault_messages.[0].[unat (i_' s)] = register_from_H r \<and> (\<forall>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) (x2 + (i_' s * 4 + 4)))) \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat (i_' s)] = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) (x2 + (i_' s * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva)) \<and> Suc (unat (i_' s + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (i_' s + 1 \<noteq> 0 \<longrightarrow> Suc (unat (i_' s + 1)) \<noteq> 0) \<and> s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4)) \<and> unat (i_' s + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (i_' s + 1 \<noteq> 0 \<longrightarrow> unat (i_' s + 1) \<noteq> 0)} \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 2. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> {s. i_' s < 0xC \<and> (\<exists>t r. kernel_all_global_addresses.fault_messages.[0].[unat (i_' s)] = register_from_H r \<and> (\<forall>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) (x2 + (i_' s * 4 + 4)))) \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat (i_' s)] = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) (x2 + (i_' s * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) v)) \<and> Suc (unat (i_' s + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (i_' s + 1 \<noteq> 0 \<longrightarrow> Suc (unat (i_' s + 1)) \<noteq> 0) \<and> s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4)) \<and> unat (i_' s + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (i_' s + 1 \<noteq> 0 \<longrightarrow> unat (i_' s + 1) \<noteq> 0)}}
 3. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 4. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 6. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 7. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv x2 n rva s. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s\<rbrakk> \<Longrightarrow> {s. i_' s < 0xC \<and> (\<exists>t r. kernel_all_global_addresses.fault_messages.[0].[unat (i_' s)] = register_from_H r \<and> (\<forall>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) (x2 + (i_' s * 4 + 4)))) \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat (i_' s)] = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) (x2 + (i_' s * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) rva)) \<and> Suc (unat (i_' s + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (i_' s + 1 \<noteq> 0 \<longrightarrow> Suc (unat (i_' s + 1)) \<noteq> 0) \<and> s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4)) \<and> unat (i_' s + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (i_' s + 1 \<noteq> 0 \<longrightarrow> unat (i_' s + 1) \<noteq> 0)} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. i_' sa < 0xC \<and> (s, r_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[0].[unat (i_' sa)]) sa) \<in> rf_sr}
 2. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> {s. i_' s < 0xC \<and> (\<exists>t r. kernel_all_global_addresses.fault_messages.[0].[unat (i_' s)] = register_from_H r \<and> (\<forall>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) (x2 + (i_' s * 4 + 4)))) \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat (i_' s)] = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) (x2 + (i_' s * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) v)) \<and> Suc (unat (i_' s + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (i_' s + 1 \<noteq> 0 \<longrightarrow> Suc (unat (i_' s + 1)) \<noteq> 0) \<and> s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4)) \<and> unat (i_' s + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (i_' s + 1 \<noteq> 0 \<longrightarrow> unat (i_' s + 1) \<noteq> 0)}}
 3. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 4. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 6. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 7. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' x2 and tcb_at' r) s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) s \<longrightarrow> ((\<lambda>_. True) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2))) s)) s \<and> s' \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> s \<in> {s. i_' s < 0xC \<and> (\<exists>t r. kernel_all_global_addresses.fault_messages.[0].[unat (i_' s)] = register_from_H r \<and> (\<forall>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) (x2 + (i_' s * 4 + 4)))) \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat (i_' s)] = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) (x2 + (i_' s * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) v)) \<and> Suc (unat (i_' s + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (i_' s + 1 \<noteq> 0 \<longrightarrow> Suc (unat (i_' s + 1)) \<noteq> 0) \<and> s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4)) \<and> unat (i_' s + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (i_' s + 1 \<noteq> 0 \<longrightarrow> unat (i_' s + 1) \<noteq> 0)}}
 2. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 3. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 5. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 6. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n; valid_pspace' s; valid_ipc_buffer_ptr' x2 s; tcb_at' r s\<rbrakk> \<Longrightarrow> is_aligned (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2 \<and> (\<forall>v. cslift s' (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n < 0xC \<and> (\<exists>t r. kernel_all_global_addresses.fault_messages.[0].[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n)] = register_from_H r \<and> ((\<exists>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat n * 4 + 4))))) \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n)] = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat n * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) v)) \<and> Suc (unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> s' \<Turnstile>\<^sub>c PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat n * 4 + 4)) \<and> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1 \<noteq> 0 \<longrightarrow> 0 < unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1)))
 2. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 3. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 5. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 6. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n; valid_pspace' s; valid_ipc_buffer_ptr' x2 s; tcb_at' r s\<rbrakk> \<Longrightarrow> is_aligned ([SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4) 2
 2. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n; valid_pspace' s; valid_ipc_buffer_ptr' x2 s; tcb_at' r s\<rbrakk> \<Longrightarrow> 2 \<le> msg_align_bits
 3. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n; valid_pspace' s; valid_ipc_buffer_ptr' x2 s; tcb_at' r s\<rbrakk> \<Longrightarrow> True \<and> (\<forall>v. cslift s' (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n < 0xC \<and> (\<exists>t r. kernel_all_global_addresses.fault_messages.[0].[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n)] = register_from_H r \<and> ((\<exists>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat n * 4 + 4))))) \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n)] = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat n * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) v)) \<and> Suc (unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> s' \<Turnstile>\<^sub>c PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat n * 4 + 4)) \<and> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1 \<noteq> 0 \<longrightarrow> 0 < unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1)))
 4. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 5. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 7. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 8. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 9. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n; valid_pspace' s; valid_ipc_buffer_ptr' x2 s; tcb_at' r s\<rbrakk> \<Longrightarrow> 2 \<le> msg_align_bits
 2. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n; valid_pspace' s; valid_ipc_buffer_ptr' x2 s; tcb_at' r s\<rbrakk> \<Longrightarrow> True \<and> (\<forall>v. cslift s' (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n < 0xC \<and> (\<exists>t r. kernel_all_global_addresses.fault_messages.[0].[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n)] = register_from_H r \<and> ((\<exists>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat n * 4 + 4))))) \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n)] = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat n * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) v)) \<and> Suc (unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> s' \<Turnstile>\<^sub>c PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat n * 4 + 4)) \<and> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1 \<noteq> 0 \<longrightarrow> 0 < unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1)))
 3. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 4. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 6. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 7. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n; valid_pspace' s; valid_ipc_buffer_ptr' x2 s; tcb_at' r s\<rbrakk> \<Longrightarrow> True \<and> (\<forall>v. cslift s' (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n < 0xC \<and> (\<exists>t r. kernel_all_global_addresses.fault_messages.[0].[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n)] = register_from_H r \<and> ((\<exists>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat n * 4 + 4))))) \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n)] = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat n * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) v)) \<and> Suc (unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> s' \<Turnstile>\<^sub>c PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat n * 4 + 4)) \<and> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1 \<noteq> 0 \<longrightarrow> 0 < unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat n + 1)))
 2. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 3. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 5. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 6. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv x2 n s s'. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; n < 13 - unat (SCAST(32 signed \<rightarrow> 32) 4 + 1); n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) 4); (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) 4 + word_of_nat n; valid_pspace' s; valid_ipc_buffer_ptr' x2 s; tcb_at' r s\<rbrakk> \<Longrightarrow> True \<and> (\<forall>v. cslift s' (PTR(32 word) (x2 + [SCAST(32 signed \<rightarrow> 32) 4 + 1 .e. 0xC] ! n * 4)) = Some v \<longrightarrow> UCAST(32 signed \<rightarrow> 32) 4 + word_of_nat n < 0xC \<and> (\<exists>t r. kernel_all_global_addresses.fault_messages.[0].[unat (UCAST(32 signed \<rightarrow> 32) 4 + word_of_nat n)] = register_from_H r \<and> ((\<exists>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) 4 * 4 + word_of_nat n * 4 + 4))))) \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat (UCAST(32 signed \<rightarrow> 32) 4 + word_of_nat n)] = register_from_H (drop (unat (SCAST(32 signed \<rightarrow> 32) 4)) (take len FaultHandler_H.syscallMessage) ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) 4 * 4 + word_of_nat n * 4 + 4)))) = local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) 4)) (take len FaultHandler_H.syscallMessage) ! n) v)) \<and> Suc (unat (UCAST(32 signed \<rightarrow> 32) 4 + word_of_nat n + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> s' \<Turnstile>\<^sub>c PTR(32 word) (x2 + (UCAST(32 signed \<rightarrow> 32) 4 * 4 + word_of_nat n * 4 + 4)) \<and> unat (UCAST(32 signed \<rightarrow> 32) 4 + word_of_nat n + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (UCAST(32 signed \<rightarrow> 32) 4 + word_of_nat n + 1 \<noteq> 0 \<longrightarrow> 0 < unat (UCAST(32 signed \<rightarrow> 32) 4 + word_of_nat n + 1)))
 2. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 3. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 5. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 6. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))))
 2. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 4. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 5. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 6. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x2 n. \<lbrakk>len \<le> 12; 4 < len; is_aligned x2 msg_align_bits; x2 \<noteq> 0; 8 \<le> len - 4\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < 0xC)
 2. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 4. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 5. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 6. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sb' +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sb' (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (sb' +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 3. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 4. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 5. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>x2 t_hrs i. \<lbrakk>len \<le> 12; 4 < len; x2 \<noteq> 0; is_aligned x2 msg_align_bits; PTR(32 word) x2 \<noteq> NULL\<rbrakk> \<Longrightarrow> i < 0xC \<longrightarrow> i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (i + 1)) (hrs_htd t_hrs) \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t (PTR(32 word) x2 +\<^sub>p uint (i + 1)) \<longrightarrow> i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (i + 1))) (hrs_htd t_hrs) \<longrightarrow> (kernel_all_global_addresses.fault_messages.[0].[unat i] = SCAST(32 signed \<rightarrow> 32) Kernel_C.CPSR \<longrightarrow> 0 \<le>s 8 \<longrightarrow> unat 1 * 2 ^ unat 8 < 2 ^ 31 \<and> 0 \<le>s 1 \<longrightarrow> 0 \<le>s 6 \<longrightarrow> unat 1 * 2 ^ unat 6 < 2 ^ 31 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.CPSR < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr r \<longrightarrow> i = i) \<and> (kernel_all_global_addresses.fault_messages.[0].[unat i] \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.CPSR \<longrightarrow> kernel_all_global_addresses.fault_messages.[0].[unat i] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr r \<longrightarrow> i = i)
 2. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 3. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 4. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 5. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> case zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)) ! n of (x, y) \<Rightarrow> do v <- loadWordUser (x2 + x * 4);
asUser r (setRegister y (local.sanitiseRegister rv y v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 2. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 3. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 4. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>rv sb sb' x2 n. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1) \<and> Suc n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace> do v <- loadWordUser (x2 + [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] ! n * 4);
asUser r (setRegister (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) (local.sanitiseRegister rv (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage) ! n) v))
od \<lbrace>\<lambda>_. valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r\<rbrace>
 2. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 3. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 4. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>rv sb sb' x2 n s. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb; Suc n < 13 - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1) \<and> Suc n < min (length FaultHandler_H.syscallMessage) len - unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters); (valid_pspace' and (case sb of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r) s\<rbrakk> \<Longrightarrow> valid_pspace' s \<and> (case sb of None \<Rightarrow> \<lambda>s. True | Some xa \<Rightarrow> valid_ipc_buffer_ptr' xa) s \<and> tcb_at' r s
 2. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 3. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 4. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>rv sb sb' x2. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; Some x2 = sb\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))) < 2 ^ word_bits
 2. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 3. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<lbrakk>len \<le> 12; 4 < len; 4294967292 \<le> min (length FaultHandler_H.syscallMessage) len - 4\<rbrakk> \<Longrightarrow> False
 2. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 3. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>rv sb sb' x2 x y. \<lbrakk>len \<le> 12; 4 < len; PTR(32 word) x2 = sb'; sb = Some x2; x2 \<noteq> 0; is_aligned x2 msg_align_bits; sb' \<noteq> NULL; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (zip [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. 0xC] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 2. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. (a = None \<longrightarrow> True) \<and> (\<forall>x. a = Some x \<longrightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa)\<rbrace>
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R5133 rv (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) (?rv5133 rv) (from_bool (?rv5133 rv)) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a aa. case a of None \<Rightarrow> True | Some x \<Rightarrow> (valid_pspace' and (case a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and tcb_at' r and (\<lambda>_. case a of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. a \<noteq> Some 0)) aa\<rbrace>
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?R5133 rv (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) (?rv5133 rv) (from_bool (?rv5133 rv)) () \<equiv>\<^sup>? \<lambda>rv. ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () proof (prove)
goal (6 subgoals):
 1. \<And>rv. \<lbrakk>len \<le> 12; 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?R5133 rv (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) (?rv5133 rv) (from_bool (?rv5133 rv)) ()\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>rv. valid_pspace' and (case rv of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and tcb_at' r and (\<lambda>_. case rv of None \<Rightarrow> True | Some x \<Rightarrow> is_aligned x msg_align_bits) and (\<lambda>_. rv \<noteq> Some 0)\<rbrace>
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and ?R4002 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV}
flex-flex pairs:
\<lambda>rv. ?R5133 rv (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) (?rv5133 rv) (from_bool (?rv5133 rv)) () \<equiv>\<^sup>? \<lambda>rv. ?R4002 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) () proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)); \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' s and (\<lambda>a. valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a \<and> True)) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)))) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage)))) (Cond (if word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len)) < word_of_nat len then UNIV else {}) (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and (\<lambda>a. valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a \<and> True)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. tcb_at' s a \<and> valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a) (?uua3732 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat len)) (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. return ())) (Cond {} (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and (\<lambda>a. valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a \<and> True)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else ?uua3732 length___unsigned_long id___anonymous_enum receiver sender rv archInfo a rv')
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. tcb_at' s a \<and> valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a) \<lbrace>\<acute>i = word_of_nat len\<rbrace> (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. return ())) (Cond {} (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and (\<lambda>a. valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a \<and> True)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else \<lbrace>\<acute>i = rv'\<rbrace>)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. tcb_at' s a \<and> valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a) \<lbrace>\<acute>i = word_of_nat len\<rbrace> (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. return ())) SKIP
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and (\<lambda>a. valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a \<and> True)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else \<lbrace>\<acute>i = rv'\<rbrace>)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5190 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv') (?Q'5190 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv') (SKIP # hs) (lookupIPCBuffer False s >>= case_option (return ()) (\<lambda>bufferPtr. return ())) SKIP
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len; tcb_at' s sa \<and> valid_pspace' sa \<and> valid_objs' sa \<and> tcb_at' r sa \<and> valid_objs' sa\<rbrakk> \<Longrightarrow> ?Q5190 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len; sa \<in> \<lbrace>\<acute>i = word_of_nat len\<rbrace>\<rbrakk> \<Longrightarrow> sa \<in> ?Q'5190 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and (\<lambda>a. valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a \<and> True)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else \<lbrace>\<acute>i = rv'\<rbrace>)
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' rva. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5194 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' rva) (?Q'5194 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' rva) (SKIP # hs) (case rva of None \<Rightarrow> return () | _ \<Rightarrow> return ()) SKIP
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>r. (=) sa\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?Q5190 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'\<rbrace> lookupIPCBuffer False s \<lbrace>?Q5194 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> empty_fail (lookupIPCBuffer False s)
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len; tcb_at' s sa \<and> valid_pspace' sa \<and> valid_objs' sa \<and> tcb_at' r sa \<and> valid_objs' sa\<rbrakk> \<Longrightarrow> ?Q5190 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len; sa \<in> \<lbrace>\<acute>i = word_of_nat len\<rbrace>\<rbrakk> \<Longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ?Q5194 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' rva s \<longrightarrow> s' \<in> ?Q'5194 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' rva}
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and (\<lambda>a. valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a \<and> True)\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else \<lbrace>\<acute>i = rv'\<rbrace>)
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>rv. \<not> 4 < len \<Longrightarrow> ccorres dc xfdc (?Q5194 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) (word_of_nat len) None) (?Q'5194 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) (word_of_nat len) None) (SKIP # hs) (return ()) SKIP
 2. \<And>rv a. \<not> 4 < len \<Longrightarrow> ccorres dc xfdc (?Q5194 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) (word_of_nat len) (Some a)) (?Q'5194 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv (from_bool rv) (word_of_nat len) (Some a)) (SKIP # hs) (return ()) SKIP
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>r. (=) sa\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?Q5190 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'\<rbrace> lookupIPCBuffer False s \<lbrace>?Q5194 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> empty_fail (lookupIPCBuffer False s)
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len; tcb_at' s sa \<and> valid_pspace' sa \<and> valid_objs' sa \<and> tcb_at' r sa \<and> valid_objs' sa\<rbrakk> \<Longrightarrow> ?Q5190 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len; sa \<in> \<lbrace>\<acute>i = word_of_nat len\<rbrace>\<rbrakk> \<Longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ?Q5194 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' rva s \<longrightarrow> s' \<in> ?Q'5194 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' rva}
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and (\<lambda>a. valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a \<and> True)\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else \<lbrace>\<acute>i = rv'\<rbrace>)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>r. (=) sa\<rbrace>
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> \<lbrace>?Q5190 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'\<rbrace> lookupIPCBuffer False s \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len\<rbrakk> \<Longrightarrow> empty_fail (lookupIPCBuffer False s)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len; tcb_at' s sa \<and> valid_pspace' sa \<and> valid_objs' sa \<and> tcb_at' r sa \<and> valid_objs' sa\<rbrakk> \<Longrightarrow> ?Q5190 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' sa. \<lbrakk>length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len; \<not> 4 < len; sa \<in> \<lbrace>\<acute>i = word_of_nat len\<rbrace>\<rbrakk> \<Longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV}
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3103 (word_of_nat len) 0 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage) \<lbrace>\<lambda>a. tcb_at' s and (\<lambda>a. valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a \<and> True)\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 0; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.syscallMessage)))) i_' (\<lambda>a rv'. if 4 < len then {s. thread_'_update (\<lambda>_. sender) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = sender\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else \<lbrace>\<acute>i = rv'\<rbrace>)
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3103 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. len \<le> unat n_syscallMessage \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len))) i_' (\<lambda>a rv'. if 4 < len then {sa. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else \<lbrace>\<acute>i = rv'\<rbrace>)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and (\<lambda>a. tcb_at' s a \<and> valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<lbrakk>len \<le> unat n_syscallMessage; 4 < len\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len))) i_' (\<lambda>a rv'. if 4 < len then {sa. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else \<lbrace>\<acute>i = rv'\<rbrace>)
 2. \<lbrakk>len \<le> unat n_syscallMessage; \<not> 4 < len\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.syscallMessage) len))) i_' (\<lambda>a rv'. if 4 < len then {sa. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) (isReceiver_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) sa) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool False\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' t) \<longrightarrow> sendBuf_'_update (\<lambda>_. ret__ptr_to_unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. rv = None \<longrightarrow> s \<in> UNIV \<inter> {s. dc a (xfdc s)}} \<inter> {s. \<forall>x. s \<in> {s. rv = Some x \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>}}} else \<lbrace>\<acute>i = rv'\<rbrace>)
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and (\<lambda>a. tcb_at' s a \<and> valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and (\<lambda>a. tcb_at' s a \<and> valid_pspace' a \<and> valid_objs' a \<and> tcb_at' r a \<and> valid_objs' a)\<rbrace>
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_syscallMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Syscall; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres dc xfdc (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and K (r \<noteq> s) and K (len \<le> unat n_syscallMessage)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat len\<rbrace>) hs (do t <- local.getSanitiseRegisterInfo r;
a <- zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.syscallMessage);
sendBuf <- lookupIPCBuffer False s;
case sendBuf of None \<Rightarrow> return () | Some bufferPtr \<Rightarrow> zipWithM_x (\<lambda>i rd. do v <- loadWordUser (bufferPtr + i * 4);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) [SCAST(32 signed \<rightarrow> 32) n_msgRegisters + 1 .e. SCAST(32 signed \<rightarrow> 32) n_syscallMessage] (drop (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) (take len FaultHandler_H.syscallMessage))
od) (Call copyMRsFaultReply_'proc)

goal:
No subgoals!